Transform to change device

[jcurry]

jcurry [http://community.zenoss.org/people/jcurry] created the discussion

"Transform to change device"

To view the discussion, visit: http://community.zenoss.org/message/70533#70533

--------------------------------------------------------------
Core 4.2 Fixpack 1.
Scenario is that I want to change the device field in a transform as events are reported by a firewall but the device that REALLY has issues is behind that firewall.  The summary includes the device name that I want the event to come from.

So, transform is:

#get new device name from summary - 4th space-separated field (starting at 0)
h=evt.summary.split()[3]
evt.reportingHost = evt.device
evt.device = h

Transform works to the extent that the device field is changed but in the Event Console the field under Resource has the correct name but does not appear as a link (the device is correct and normal events from this device do appear as a link).

In addition, there is no device context fields - Location, deviceClass, Systems, etc...

Looking at the trace in zeneventd.log I can see that it notices that the device has changed and the UpdateDeviceContextAndTags method is called - but this only clears the device context fields - it does not "reident" them.  My assumption was that the TransformAndReidentPipe ought to redo the AddDeviceContextAndTagsPipe but it does not appear to be doing that.

Is my assumption about reident correct - and it isn't working?

Or is this a bad assumption?

Any other bright ideas for changing the device (and all its associated device context) in a 4.2 transform??

Cheers,
Jane
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/70533#70533]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[themactech]

themactech [http://community.zenoss.org/people/themactech] created the discussion

"Re: Transform to change device"

To view the discussion, visit: http://community.zenoss.org/message/70535#70535

--------------------------------------------------------------
I had done a test where I encoded a event into an email, and re-created it at another location from the received email with zensendevent.

Would it be an option to have your event trigger a script where:

-it passes along all the event info you need
-drops the current event
-creates a new event with the device you want with the fields from the previous event

Just a thought

Manuel
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/70535#70535]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[rtelford]

rtelford [http://community.zenoss.org/people/rtelford] created the discussion

"Re: Transform to change device"

To view the discussion, visit: http://community.zenoss.org/message/72828#72828

--------------------------------------------------------------
Jane,

We have come across the same issue, having a look through the code our developers thought this looked like a bug. 

I have attached his comments and a patch. The patch seems to be working for us without any bad side effects (so far :-)

Rod.

If the evt.device is changed/set from a transform, the zeneventd code
attempts to identify the named zenoss device and associate it's UUID with
the event, however a later stage in the pipeline incorrectly clears the
device UUID, breaking the linkage.
Specifically, the EventPipelineProcessor pipeline calls
TransformAndReidentPipe, which runs the transform and then, if the
device name or component names have changed, runs IdentifierPipe and
then UpdateDeviceContextAndTagsPipe. IdentifierPipe correctly finds the
device and sets the UUID, but UpdateDeviceContextAndTagsPipe clears it.
I would assume this clearing is a mistake as it does not match the
associated comment: "Clear title fields".
The attached patch fixes the issue.
Index: zenoss/Products/ZenEvents/events2/processing.py
===================================================================
--- zenoss.orig/Products/ZenEvents/events2/processing.py
+++ zenoss/Products/ZenEvents/events2/processing.py
@@ -582,7 +582,6 @@ class UpdateDeviceContextAndTagsPipe(Add
             # Clear title fields
             actor = eventContext.event.actor
             actor.ClearField(EventField.Actor.ELEMENT_TITLE)
-            actor.ClearField(EventField.Actor.ELEMENT_UUID)
             actor.ClearField(EventField.Actor.ELEMENT_SUB_TITLE)
             eventContext.log.debug("device was cleared, must purge references in current event: %s" % to_dict(eventContext._zepRawEvent))

--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/72828#72828]

Start a new discussion in zenoss-users at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[rtelford]

rtelford [http://community.zenoss.org/people/rtelford] created the discussion

"Re: Transform to change device"

To view the discussion, visit: http://community.zenoss.org/message/72832#72832

--------------------------------------------------------------
I should update this.  In the scenario where the device where the actual trap is comming from is being monitorded by zenoss, you will need to set both evt.device and evt.ipAddress or this technique will not work. Most of my NMS systems that forward traps include the ne name and the ne ipaddress where error orinated.

For example, I map the  AdvaNMS events like this

# Map the base parameters
evt.device = evt.neName
evt.ipAddress = evt.neIpAddress
# And the others

evt.component = evt.entity
evt.summary = evt.description
evt.eventKey = evt.name
evt.ipAddress = evt.neIpAddress



If you cant get the ipddr you may need to use a DNS lookup inside the transform. Something like this would be equivelent to above if my event did not include the originating ip address

import socket
evt.device = evt.neName
evt.ipAddress = socket.gethostbyname(evt.device)
# And the others
evt.component = evt.entity
evt.summary = evt.description
evt.eventKey = evt.name
evt.ipAddress = evt.neIpAddress

I hope this helps.

Rod.
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/72832#72832]

Start a new discussion in zenoss-users at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]