For our enterprise, we have decided to turn off the monitoring of interfaces by default. (See my other article on how to turn ON/OFF monitoring of all the interfaces on a device or device class.) We turn on monitoring only on those ports that are important. However, this doesn't prevent syslog LINK-3-UPDOWN messages from coming through for every port. Since we have monitoring set for important ports, I decided to use the monitor setting as a filter.

The result of this transform is that ports that are monitored can generate LINK UP/DOWN events. Ports that are not monitored have their LINK UP/DOWN events discarded. I added the following transform to the LINK-3-UPDOWN and LINK-3-UP events in /Events/Net/Link:

interfaceID = evt.component.replace('/', '_')
interface = getattr(device.os.interfaces, interfaceID, None)
if not (interface is None):
   if not (interface.monitor):
      evt._action = 'drop'

Line-by-line explanation

1. interfaceID = evt.component.replace('/', '_')
   (See below)
2. interface = getattr(device.os.interfaces, interfaceID, None)
   Retrieve the interface object that generated the LINK UP/DOWN event. If interfaceID is not found, return the None object.
   
3. if not (interface is None):
   Verify that we successfully retrieved the object
4. if not (interface.monitor):
   If the port is not being monitored
5. evt._action = 'drop'
   Discard the event

Why is interfaceID required on line 1?

1. I'll show you. Navigate to any Cisco switch or router device in your Zenoss system. The URL will be something like:
   http://zenoss:8080/zport/dmd/Devices/Network/Switch/devices/CiscoSwitch1
2. Click on the OS tab. You will see a list of interfaces like this:
   
   Notice that the interface names contain a '/' character.
   
3. Add /manage to the end of the URL and hit enter. This will take you to the Zope interface. The URL should now be something like:
   http://zenoss:8080/zport/dmd/Devices/Network/Switch/devices/CiscoSwitch1/manage
4. The Zope interface of the Device object will look like the image below. Click on the os link:
   
   
5. The Zope interface of the OS object will look like the image below. Click on the interfaces link:
   
   
6. Finally, you see the list of interface objects in the device. Notice that the names of the objects do not contain any '/' characters. This is because python identifiers can only contain letters, numbers, or the "_" character. Therefore, in order to retrieve the interface object, we must convert the interface name as it is passed by the syslog message (e.g. 'FastEthernet0/1") to the object name as it is stored in Zope ("FastEthernet0_1"). That is what line 1 is for.