One thing I learned from playing around...

Go to Advanced -> Settings -> Users. The select one of the groups (in my case "Domain Admins"), go to Administered Objects, then add the / device class permission. The users in the group will then be able to go to Infrastructure -> devices -> Details -> events and see the current events. However, they will not be able to see events in the Events tab which is where I want them to appear.

Its a bit closer to a solution, but not sure its all the way there... Anybody have more information on how to add permissions to groups? How do I permission a group to see active events in the events tab versus the Infrastructure tab?

Looking at the documentation and the GUI the only thing I can give groups permission to (that I can use to influence what events they can see) are deviceclasses. Personally, I would like to see a request for enhancement here so that I can permission on event class as well. That would be a great feature.

Given that I can only use deviceClasses for permissioning (I plan to have multiple groups each with access to different events) I looked at playing with transforms to influence the DeviceClasses. I learned a few things:

* First, you can't set the DeviceClass in an event transform. It lets you do it, and shows it as changed, but it will always put the event in the same deviceclass that the device the event is from comes to. I tested this by setting the deviceclass to an abitrary class in my tree and the event didn't appear in the proper class.

* Second, the only way to influence the deviceclass is to create devices in the infrastucture view. The events will follow where that device lives. This forces me into a model where Zenoss wants to probe the devices for status. I don't want to use zenoss for that. I want to use it as a trap and event receiver and not as a probe. As I add more and more devices into my network, a central zenoss server does not scale as well as a distributed model where the devices with issues tell zenoss their problems. AT MOST, all I want Zenoss to do is make sure the device is still alive (right now I have Nagios configured for that).

* Third, only my admin user can add devices. Apparently when I add a device as an LDAP user it ignores the device and doesn't create a task for it.

So, back to the questions...

* Why can't my LDAP users see events in the events view, but CAN see events in the Infrastructure view? Is this a Zenoss Core limitation or something with LDAP permissions?

* What is the best way to configure this?

I would love any and all feedback from people. I'm leveraging the forums to encourage communication, but the only person responding has the same issue as me and no solutions on how to move forward either... Is there a better way to raise issues with the Zenoss developers?

Thanks,

Scott

Thomas, I tested out your change... I noticed a few things when I did that...

First, I can see all events in the events page. Which is good. But sadly I lose the ability to manage group permissions. Going to Advanced -> settings -> users and looking at the group permissions I see nothing there. That is important if I not only want to authentication users but also do some sort of access control for them.

Second, I started seeing zenoss failure events around handling an empty set. I have to assume its related.

Rob, I'm looking into your idea.. I think its a bit hacky...but its working so far. I'm going to continue to play with it and let y'all know how it works out.

Thanks,

Scott