I think you should use the field name Zenoss shows in your screenshot...

so

evt.message = evt.1.3.6.1.4.34268.1.1.1

Though if you get the MIBs working right, that should just work for the

traps too.

--

James Pulver

Information Technology Area Supervisor

LEPP Computer Group

Cornell University

drnoelkelly wrote, On 1/7/2010 5:40 AM:

Hi,

 

I am very new to Zenoss and SNMP in general.  I have a software application which sends SNMPv1 traps to a customer's Zenoss system.

 

When a trap arrives the string I am sending gets added by zentrap as a new field using the OID as per the manual:

 

"In addition to the standard fields, Zenoss also allows events to add an arbitrary number of additional name/value pairs to events to give them more context. The name and value of these details are limited to 255 characters in length." (docs/DOC-3923#d4e3729 (docs/DOC-3923))

 

See attached screenshots for example of this trap details.  I note that the Cisco 1100 AP traps are also getting the same treatment so I think my SNMPv1 trap generation is correct.

 

Presently the summary message in the console says 'snmp trap 1.3.6.1.4.1.9.9.41.2.1'.  I have therefore tried to add a transform to map the generated OID/string to the Summary/string:

 

evt.message = evt.1.3.6.1.4.1.9.9.41.1.2.3.1.5.5

 

However this just errors immediately.  I thought it might be python syntax errors so I escaped the '.' (ie evt.1\.3\.6\.1\.etc) but that doesn't help.

 

A transform using one of the other fields works fine (ie 'evt.message = evt.evid').

 

Does anyone know how to make this transform work?  Or better to avoid this transform entirely by making zentrap use the sent string as the summary/message field for this OID.

 

I have written a simple MIB to help Zenoss interpret these traps but it doesn't seem to use any of that information so I am not sure if that is the way to handle this automatically?

 

Any ideas much appreciated,

 

Cheers

N

>

Man, I don't recall ever trying to use dynamically generated fields per

se... Have you looked at the Event Management Paper by Jane Curry?

http://www.skills-1st.co.uk/papers/jane/zenoss_event_management_paper.pdf

--

James Pulver

Information Technology Area Supervisor

LEPP Computer Group

Cornell University

drnoelkelly wrote, On 1/7/2010 11:41 AM:

Thanks James. 

 

That is really the nub of the problem.  When I use "evt.message = evt.1.3.6.1.4.34268.1.1.1" in the transforms I get a red transforms box (see attached) and it does not execute.  That was why I was toying with the idea it could be a python syntax issue or perhaps these dynamically generated event fields are not accessible to transforms?

 

Cheers

N

>