Archived community.zenoss.org | full text search
Skip navigation
46991 Views 5 Replies Latest reply: Jan 8, 2010 6:35 AM by drnoelkelly RSS
drnoelkelly Newbie 3 posts since
Jan 6, 2010
Currently Being Moderated

Jan 7, 2010 5:40 AM

zentrap fields and transforms

Hi,

 

I am very new to Zenoss and SNMP in general.  I have a software application which sends SNMPv1 traps to a customer's Zenoss system.

 

When a trap arrives the string I am sending gets added by zentrap as a new field using the OID as per the manual:

 

"In addition to the standard fields, Zenoss also allows events to add an arbitrary number of additional name/value pairs to events to give them more context. The name and value of these details are limited to 255 characters in length." (docs/DOC-3923#d4e3729)

 

See attached screenshots for example of this trap details.  I note that the Cisco 1100 AP traps are also getting the same treatment so I think my SNMPv1 trap generation is correct.

 

Presently the summary message in the console says 'snmp trap 1.3.6.1.4.1.9.9.41.2.1'.  I have therefore tried to add a transform to map the generated OID/string to the Summary/string:

 

evt.message = evt.1.3.6.1.4.1.9.9.41.1.2.3.1.5.5

 

However this just errors immediately.  I thought it might be python syntax errors so I escaped the '.' (ie evt.1\.3\.6\.1\.etc) but that doesn't help.

 

A transform using one of the other fields works fine (ie 'evt.message = evt.evid').

 

Does anyone know how to make this transform work?  Or better to avoid this transform entirely by making zentrap use the sent string as the summary/message field for this OID.

 

I have written a simple MIB to help Zenoss interpret these traps but it doesn't seem to use any of that information so I am not sure if that is the way to handle this automatically?

 

Any ideas much appreciated,

 

Cheers

N

Attachments:
  • jmp242 ZenossMaster 4,060 posts since
    Mar 7, 2007
    Currently Being Moderated
    1. Jan 7, 2010 8:56 AM (in response to drnoelkelly)
    Re: zentrap fields and transforms

    I think you should use the field name Zenoss shows in your screenshot...

    so

    evt.message = evt.1.3.6.1.4.34268.1.1.1

     

    Though if you get the MIBs working right, that should just work for the

    traps too.

    --

    James Pulver

    Information Technology Area Supervisor

    LEPP Computer Group

    Cornell University

     

     

     

    drnoelkelly wrote, On 1/7/2010 5:40 AM:

    Hi,

     

    I am very new to Zenoss and SNMP in general.  I have a software application which sends SNMPv1 traps to a customer's Zenoss system.

     

    When a trap arrives the string I am sending gets added by zentrap as a new field using the OID as per the manual:

     

    "In addition to the standard fields, Zenoss also allows events to add an arbitrary number of additional name/value pairs to events to give them more context. The name and value of these details are limited to 255 characters in length." (docs/DOC-3923#d4e3729 (docs/DOC-3923))

     

    See attached screenshots for example of this trap details.  I note that the Cisco 1100 AP traps are also getting the same treatment so I think my SNMPv1 trap generation is correct.

     

    Presently the summary message in the console says 'snmp trap 1.3.6.1.4.1.9.9.41.2.1'.  I have therefore tried to add a transform to map the generated OID/string to the Summary/string:

     

    evt.message = evt.1.3.6.1.4.1.9.9.41.1.2.3.1.5.5

     

    However this just errors immediately.  I thought it might be python syntax errors so I escaped the '.' (ie evt.1\.3\.6\.1\.etc) but that doesn't help.

     

    A transform using one of the other fields works fine (ie 'evt.message = evt.evid').

     

    Does anyone know how to make this transform work?  Or better to avoid this transform entirely by making zentrap use the sent string as the summary/message field for this OID.

     

    I have written a simple MIB to help Zenoss interpret these traps but it doesn't seem to use any of that information so I am not sure if that is the way to handle this automatically?

     

    Any ideas much appreciated,

     

    Cheers

    N

    >

  • jmp242 ZenossMaster 4,060 posts since
    Mar 7, 2007
    Currently Being Moderated
    3. Jan 7, 2010 11:48 AM (in response to drnoelkelly)
    Re: zentrap fields and transforms

    Man, I don't recall ever trying to use dynamically generated fields per

    se... Have you looked at the Event Management Paper by Jane Curry?

     

    http://www.skills-1st.co.uk/papers/jane/zenoss_event_management_paper.pdf

    --

    James Pulver

    Information Technology Area Supervisor

    LEPP Computer Group

    Cornell University

     

     

     

    drnoelkelly wrote, On 1/7/2010 11:41 AM:

    Thanks James. 

     

    That is really the nub of the problem.  When I use "evt.message = evt.1.3.6.1.4.34268.1.1.1" in the transforms I get a red transforms box (see attached) and it does not execute.  That was why I was toying with the idea it could be a python syntax issue or perhaps these dynamically generated event fields are not accessible to transforms?

     

    Cheers

    N

    >

  • chitambira Rank: Brown Belt 711 posts since
    Oct 15, 2008
    Currently Being Moderated
    4. Jan 8, 2010 4:29 AM (in response to jmp242)
    Re: zentrap fields and transforms
    obviously its wrong syntax to try and use any field that contans a period (.) in its name, since in all Object Oriented Programming the period joins up the path to a child object following its inheritance hierachy. So you field names are not properly named.

More Like This

  • Retrieving data ...

Legend

  • Correct Answers - 4 points
  • Helpful Answers - 2 points