Event Transforms : Event Transforms & Examples : Comments

RE: Event Transforms & Examples

community@zenoss.org — Wed, 16 Jun 2010 18:45:51 GMT

Can someone elaborate on this statement? "You have to go into the event mapping, edit and put the transform there." I made several attempts to add a transform on bad OID via /Perf/SNMP from the example and nothing is working to drop the events via the class or higher.

Thanks,

- Ken

RE: Event Transforms & Examples

community@zenoss.org — Wed, 16 Jun 2010 20:27:37 GMT

This has to do with where you place the Transform. I suggest you first fully read the section of the admin guide about Transforms, it explains some basics there. http://docs.zenoss.com

Also you have to understand what mappings are. Read too about these. Mappings allow unmapped events (there are not many - stuff like eventlogs, syslogs) to be put into an event class. Most events made by zenoss already have an event class assigned to them. These do not need mappings. So really, it depends on if the events you are trying to effect, come in with a mapping or already have them.

If you dont see a transform working, check the zenhub.log to make sure there isnt a traceback in it. Maybe the transform code doesnt work on newer versions, or it was wrong to begin with. If so, it will show in this log, and you have to fix it. Goodluck

Can someone elaborate on this statement? "You have to go into the event mapping, edit and put the transform there." I made several attempts to add a transform on bad OID via /Perf/SNMP from the example and nothing is working to drop the events via the class or higher.

Thanks,
- Ken

RE: Event Transforms & Examples

community@zenoss.org — Fri, 04 Mar 2011 00:01:16 GMT

Hello,

The "Interface High Utilization event enhancement using if,then,else" is something I have been looking for.

However when this is event is triggered I am getting the following in my email alert:

"threshold of high utilization exceeded: current value 1958856.28"

In the zenhub.log I am seeing the following when the event is triggered.

Problem on line 28: NameError: name 'evtNewKey' is not defined
evt.summary = "High " + evtNewKey + " Utilization: Currently (%3.2f Mbps) or %3.2f%% is being used." % (Usage, p)

I am running Zenoss Core version 3.0.3 on a RHEL 5.5 x86_64 server.

I do not understand python and will look on the web and see if i can find a solution but thought I would ask here as well.

Please let me know what the solution is or if you need more information.

TIA,

brian

RE: Event Transforms & Examples

community@zenoss.org — Wed, 25 May 2011 19:38:03 GMT

Follow the logic of the code - evtNewKey is defined right above that code in the two ifs:

   if evtKey == "ifInOctets_ifInOctets|high utilization":
       evtNewKey = "Input"
   elif evtKey == "ifOutOctets_ifOutOctets|high utilization":
       evtNewKey = "Output"

Maybe one of those ifs is not being run, and so the variable is not being initialized or set.

Can you try changing to:

   if evtKey == "ifInOctets_ifInOctets|high utilization":
       evtNewKey = "Input"
   elif evtKey == "ifOutOctets_ifOutOctets|high utilization":
       evtNewKey = "Output"
   else:
       evtNewKey = "Input or Output"

RE: Event Transforms & Examples

community@zenoss.org — Tue, 31 May 2011 19:17:43 GMT

Thanks Nick! that worked. But now i'm facing another issue, for some reason the 'event summary' is showing incorrect values for interface utilization events. Sometimes the utilization event comes for High Outbound utilization but displays the values of Inbound traffic and vice versa.

For example:

Below event view details is for an Interface with HighOutput utilization and the event dedupid is for Outbound traffic but the value is showing of Inbound traffic. The Outbound traffic utilization value should have been something around 3.8 Mbps

Message: threshold of high utilization exceeded: current value 116402.76

summary: High Input or Output Utilization: Currently (931.22 Kbps) or 30.31% is being used.

Not sure if the transform is working properly, please advise.....

Thanks,

Subba

RE: Event Transforms & Examples

community@zenoss.org — Tue, 11 Oct 2011 18:25:18 GMT

Great examples. I'm wondering if its possible to have an event transformation check for other events or other device status. For example, I have two ActiveMQ brokers I monitor via JMX in an active/passive failover. The passive reports "Connection refused" when it is not active. I want to set both of these to Info and only transform to Error when connections on both devices are refused.

RE: Event Transforms & Examples

community@zenoss.org — Thu, 29 Dec 2011 16:57:48 GMT

Subba,

Are you using SNMP v1 or v2c for your device? I had the same problem and was able to resolve it by modifying the template to use the 64bit counter variables. Here is what I changed:

# Whether Input or Output Traffic

if evtKey == "ifHCInOctets_ifHCInOctets|high utilization":

evtNewKey = "Input"

elif evtKey == "ifHCOutOctets_ifHCOutOctets|high utilization":

evtNewKey = "Output"

This allowed the transform to properly detect whether it was Input or Ouput.

Best,

Matthew

RE: Event Transforms & Examples

community@zenoss.org — Wed, 28 Mar 2012 20:12:31 GMT

Here is a transform that will run a command (sqlplus in my example) and append the output of the script to the event message. I used this with a threshold alert on database jobs that were running too long, to show which jobs were running too long.

from subprocess import Popen, PIPE

if evt.device == '<devicename>':

cmd = Popen(['sqlplus -s <sql.sql'], stdout=PIPE, shell=True)

output = cmd.communicate()[0]

evt.message += "\n" + output