Archived community.zenoss.org | full text search
Skip navigation
Up to Discussions in zenoss-windows
1079 Views 4 Replies Latest reply: Aug 19, 2013 10:10 AM by A K RSS
A K Newbie
A K
5 posts since
Jul 31, 2013
Currently Being Moderated

Aug 15, 2013 2:32 PM

Filtering Options

Hey,

 

Back again, as from my previous post about bad counter event showing up and the nice gentleman who replied with a solution so I figured I try this one on my own but sadly it did not work.

 

What i did was under http://zenossip/events/status > bottom gear > transform and added these lines to the script to help not see these events..

 

if evt.summary.startswith("Windows detected"):
if "Windows detected your registry file is still in use" in evt.summary:
  evt._action = "drop"

 

if evt.summary.startswith("Driver"):
if "Driver required for printer" in evt.summary:
  evt._action = "drop"



 

So basically I keep getting a printer driver warning about drivers not being available, but noone has any issues printing, as this server is the hosting server for all network printers... i basically want it to piss off with these unwanted events. I wish Zenoss just had an option to highlight an event and select dont ever show these types of events. and done. but sadly Zenoss isn't that user friendly.

 

should I place this teansform script under the WMI section of events, or maybe did i write it wrong? I attempted to look for an eventkey but one did not exist so im trying to filter it by summary information.. any help is greatly apprictaed as always.

 

thanks!

  • jmp242 ZenossMaster
    jmp242
    4,060 posts since
    Mar 7, 2007
    Currently Being Moderated
    1. Aug 15, 2013 3:24 PM (in response to A K)
    Re: Filtering Options

    You need to apply the Transform in the event class the event ends up in. Can you screenshot an example event? You probably don't need both above to match on the summary...

     

    --

    James Pulver

    ZCA Member

    CLASSE Computer Group

    Cornell University

  • A K Newbie
    A K
    5 posts since
    Jul 31, 2013
    Currently Being Moderated
    2. Aug 16, 2013 10:15 AM (in response to jmp242)
    Re: Filtering Options

    Sorry i tryed to add a screen shot, but every picture I attempted to "add image from computer" then I would browse to th elocation o fmy image and the insert image would stay greyed out.... was driving me crazy, and pissed me off a little this morning.... so instead ill post the event info manually...

     

     

     

    agentzeneventlog
    componentMicrosoft-Windows-TerminalServices-Printers
    dedupiddev.me.com|Microsoft-Windows-TerminalServices-Printers|/Unknown|4|Driver Foxit Reader PDF Printer Driver required for printer Foxit Reader PDF Printer is unknown. Contact the administrator to install the driver before you log in again.
    eventClass/Unknown
    eventClassKeyMicrosoft-Windows-TerminalServices-Printers_1111
    eventClassMapping
    eventGroupSystem
    eventKey
    eventStateNew
    evid000c298f-1444-bb75-11e3-05df23c97cfd
    facility
    messageDriver Foxit Reader PDF Printer Driver required for printer Foxit Reader PDF Printer is unknown. Contact the administrator to install the driver before you log in again.
    ntevid1111
    priority
    severity4
    summaryDriver Foxit Reader PDF Printer Driver required for printer Foxit Reader PDF Printer is unknown. Contact the administrator to install the driver before you log in again.

     

     

     

     

     

     

     

    Hey

     

     

     

     

     

     

     

     

     

    sorry about the layout, html code is gettin scewed!

    I get about 7 of these for different software, adobe, cutepdf, etc

     

    and I get registry file in use events evrytime someone rdp's into this server, which also seems like a useless event as I can never track the issue as the PID provided in the event is for svchost process, and I'm sure its just being stupid... anyway.. as you can see they are happening in the unknown class... so i should place the transform in that section instead? Thanks for the help man

  • jmp242 ZenossMaster
    jmp242
    4,060 posts since
    Mar 7, 2007
    Currently Being Moderated
    3. Aug 16, 2013 10:35 AM (in response to A K)
    Re: Filtering Options

    So it's in the /Unknown event class. So you probably don't even need a transform. Just use the little upside down candlestick / Map Event GUI to map that to an /Ignore event class...

     

    --

    James Pulver

    ZCA Member

    CLASSE Computer Group

    Cornell University

  • A K Newbie
    A K
    5 posts since
    Jul 31, 2013
    Currently Being Moderated
    4. Aug 19, 2013 10:10 AM (in response to jmp242)
    Re: Filtering Options

    Thanks for the reply..

     

    1) This sounds like a rough solution in the event that a event that I would actually care to recieve might be recieved under the unkown class and then I would never get the event as all unknown class events would be ignored... Not really a great solution..

     

    2) I'd rather just filter event I see and don't want to get based more on the actual event then just their class types.

     

    I also not even sure where this mapping of event classes are or works. but thanks for the help. Looks like now that I placed my transform script under the unknown class, it seemed to have worked. I'll mark your first reply as the answer.

More Like This

  • Retrieving data ...

Legend

  • Correct Answers - 4 points
  • Helpful Answers - 2 points