Changing Interface Threshold Events to Display % Utilization

The default interface utilization threshold events Zenoss can be hard to understand. They will show you the current value as the throughput in bytes/sec instead of the percentage utilized. You can fix this by applying a single event class transform on the /Perf/Interface event class by following the steps below.

Creating the Event Class Transform

Follow these steps to create the event class transform.

1. Go to /Events/Perf/Interface in the web interface.
2. Click the menu and choose More -> Transform.
3. Paste the code below into the Transform box.
4. Click Save.
5. Move any existing interface threshold events to history.
   

import re
match = re.search('threshold of [^:]+: current value ([\d\.]+)', evt.message)
if match and device:
    ifaces = [ i for i in device.os.interfaces() if i.name() == evt.component ]
    if len(ifaces) > 0:
        current = float(match.groups()[0]) * 8
        speed = ifaces[0].speed
        util = (current / speed) * 100
        evt.summary = "interface utilization at %3.1f%%" % (util,)

Results

The interface threshold event would have originally looked liked this:

threshold of high utilization not met: current value 626704.00

After this transform is applied it will now look like this:

interface utilization at 86.3%