Aug 15, 2013 2:32 PM
Filtering Options
-
Like (0)
Hey,
Back again, as from my previous post about bad counter event showing up and the nice gentleman who replied with a solution so I figured I try this one on my own but sadly it did not work.
What i did was under http://zenossip/events/status > bottom gear > transform and added these lines to the script to help not see these events..
if evt.summary.startswith("Windows detected"):
if "Windows detected your registry file is still in use" in evt.summary:
evt._action = "drop"
if evt.summary.startswith("Driver"):
if "Driver required for printer" in evt.summary:
evt._action = "drop"
So basically I keep getting a printer driver warning about drivers not being available, but noone has any issues printing, as this server is the hosting server for all network printers... i basically want it to piss off with these unwanted events. I wish Zenoss just had an option to highlight an event and select dont ever show these types of events. and done. but sadly Zenoss isn't that user friendly.
should I place this teansform script under the WMI section of events, or maybe did i write it wrong? I attempted to look for an eventkey but one did not exist so im trying to filter it by summary information.. any help is greatly apprictaed as always.
thanks!
You need to apply the Transform in the event class the event ends up in. Can you screenshot an example event? You probably don't need both above to match on the summary...
--
James Pulver
ZCA Member
CLASSE Computer Group
Cornell University
Sorry i tryed to add a screen shot, but every picture I attempted to "add image from computer" then I would browse to th elocation o fmy image and the insert image would stay greyed out.... was driving me crazy, and pissed me off a little this morning.... so instead ill post the event info manually...
agent | zeneventlog |
component | Microsoft-Windows-TerminalServices-Printers |
dedupid | dev.me.com|Microsoft-Windows-TerminalServices-Printers|/Unknown|4|Driver Foxit Reader PDF Printer Driver required for printer Foxit Reader PDF Printer is unknown. Contact the administrator to install the driver before you log in again. |
eventClass | /Unknown |
eventClassKey | Microsoft-Windows-TerminalServices-Printers_1111 |
eventClassMapping | |
eventGroup | System |
eventKey | |
eventState | New |
evid | 000c298f-1444-bb75-11e3-05df23c97cfd |
facility | |
message | Driver Foxit Reader PDF Printer Driver required for printer Foxit Reader PDF Printer is unknown. Contact the administrator to install the driver before you log in again. |
ntevid | 1111 |
priority | |
severity | 4 |
summary | Driver Foxit Reader PDF Printer Driver required for printer Foxit Reader PDF Printer is unknown. Contact the administrator to install the driver before you log in again. |
Hey
sorry about the layout, html code is gettin scewed!
I get about 7 of these for different software, adobe, cutepdf, etc
and I get registry file in use events evrytime someone rdp's into this server, which also seems like a useless event as I can never track the issue as the PID provided in the event is for svchost process, and I'm sure its just being stupid... anyway.. as you can see they are happening in the unknown class... so i should place the transform in that section instead? Thanks for the help man
So it's in the /Unknown event class. So you probably don't even need a transform. Just use the little upside down candlestick / Map Event GUI to map that to an /Ignore event class...
--
James Pulver
ZCA Member
CLASSE Computer Group
Cornell University
Thanks for the reply..
1) This sounds like a rough solution in the event that a event that I would actually care to recieve might be recieved under the unkown class and then I would never get the event as all unknown class events would be ignored... Not really a great solution..
2) I'd rather just filter event I see and don't want to get based more on the actual event then just their class types.
I also not even sure where this mapping of event classes are or works. but thanks for the help. Looks like now that I placed my transform script under the unknown class, it seemed to have worked. I'll mark your first reply as the answer.
Follow Us On Twitter »
|
Latest from the Zenoss Blog » | Community | Products | Services Resources | Customers Partners | About Us | ||
Copyright © 2005-2011 Zenoss, Inc.
|
||||||||