Jan 7, 2010 5:40 AM
zentrap fields and transforms
-
Like (0)
Hi,
I am very new to Zenoss and SNMP in general. I have a software application which sends SNMPv1 traps to a customer's Zenoss system.
When a trap arrives the string I am sending gets added by zentrap as a new field using the OID as per the manual:
"In addition to the standard fields, Zenoss also allows events to add an arbitrary number of additional name/value pairs to events to give them more context. The name and value of these details are limited to 255 characters in length." (docs/DOC-3923#d4e3729)
See attached screenshots for example of this trap details. I note that the Cisco 1100 AP traps are also getting the same treatment so I think my SNMPv1 trap generation is correct.
Presently the summary message in the console says 'snmp trap 1.3.6.1.4.1.9.9.41.2.1'. I have therefore tried to add a transform to map the generated OID/string to the Summary/string:
evt.message = evt.1.3.6.1.4.1.9.9.41.1.2.3.1.5.5
However this just errors immediately. I thought it might be python syntax errors so I escaped the '.' (ie evt.1\.3\.6\.1\.etc) but that doesn't help.
A transform using one of the other fields works fine (ie 'evt.message = evt.evid').
Does anyone know how to make this transform work? Or better to avoid this transform entirely by making zentrap use the sent string as the summary/message field for this OID.
I have written a simple MIB to help Zenoss interpret these traps but it doesn't seem to use any of that information so I am not sure if that is the way to handle this automatically?
Any ideas much appreciated,
Cheers
N
I think you should use the field name Zenoss shows in your screenshot...
so
evt.message = evt.1.3.6.1.4.34268.1.1.1
Though if you get the MIBs working right, that should just work for the
traps too.
--
James Pulver
Information Technology Area Supervisor
LEPP Computer Group
Cornell University
drnoelkelly wrote, On 1/7/2010 5:40 AM:
Hi,
I am very new to Zenoss and SNMP in general. I have a software application which sends SNMPv1 traps to a customer's Zenoss system.
When a trap arrives the string I am sending gets added by zentrap as a new field using the OID as per the manual:
"In addition to the standard fields, Zenoss also allows events to add an arbitrary number of additional name/value pairs to events to give them more context. The name and value of these details are limited to 255 characters in length." (docs/DOC-3923#d4e3729 (docs/DOC-3923))
See attached screenshots for example of this trap details. I note that the Cisco 1100 AP traps are also getting the same treatment so I think my SNMPv1 trap generation is correct.
Presently the summary message in the console says 'snmp trap 1.3.6.1.4.1.9.9.41.2.1'. I have therefore tried to add a transform to map the generated OID/string to the Summary/string:
evt.message = evt.1.3.6.1.4.1.9.9.41.1.2.3.1.5.5
However this just errors immediately. I thought it might be python syntax errors so I escaped the '.' (ie evt.1\.3\.6\.1\.etc) but that doesn't help.
A transform using one of the other fields works fine (ie 'evt.message = evt.evid').
Does anyone know how to make this transform work? Or better to avoid this transform entirely by making zentrap use the sent string as the summary/message field for this OID.
I have written a simple MIB to help Zenoss interpret these traps but it doesn't seem to use any of that information so I am not sure if that is the way to handle this automatically?
Any ideas much appreciated,
Cheers
N
>
Thanks James.
That is really the nub of the problem. When I use "evt.message = evt.1.3.6.1.4.34268.1.1.1" in the transforms I get a red transforms box (see attached) and it does not execute. That was why I was toying with the idea it could be a python syntax issue or perhaps these dynamically generated event fields are not accessible to transforms?
Cheers
N
Man, I don't recall ever trying to use dynamically generated fields per
se... Have you looked at the Event Management Paper by Jane Curry?
http://www.skills-1st.co.uk/papers/jane/zenoss_event_management_paper.pdf
--
James Pulver
Information Technology Area Supervisor
LEPP Computer Group
Cornell University
drnoelkelly wrote, On 1/7/2010 11:41 AM:
Thanks James.
That is really the nub of the problem. When I use "evt.message = evt.1.3.6.1.4.34268.1.1.1" in the transforms I get a red transforms box (see attached) and it does not execute. That was why I was toying with the idea it could be a python syntax issue or perhaps these dynamically generated event fields are not accessible to transforms?
Cheers
N
>
Thanks for the reply. According to this http://docs.python.org/reference/lexical_analysis.html the period is used as a delimiter in python and that was why I was trying to escape it.
Does anyone have any pointers on escaping these periods from the variable name so that it can be used in this python transform?
Follow Us On Twitter »
|
Latest from the Zenoss Blog » | Community | Products | Services Resources | Customers Partners | About Us | ||
Copyright © 2005-2011 Zenoss, Inc.
|
||||||||