Michael J. Rogers
| Subject: |
RE: Notification Scheduling |
| Author: |
Arthur |
| Posted: |
2020-12-02 17:17 |
Hi Kai
Here is my proposal. It hopefully takes the hint from Michael into accout as we should not run in a stake trace if the component is missing.
In addition I used the
time.localtime()[6] function to get the day of the week. Any how if your transform is working ok that fine too.
Identation is important!
#Drop alerts for "name of component" each Monday from 00:00 - 12:00 CET
if evt.component and evt.component == 'name_of_component':
import re
import os
import time
os.environ['TZ'] = 'Europe/Zurich'
if time.localtime()[6] == 0:
if time.localtime()[3] >= 0 and time.localtime()[3] < 12:
evt._action = 'drop'
P.S. Sorry for the delay but I was a bit busy and thanks Michael for his appreciated input. I have to go over my transforms now :-)
------------------------------
Arthur
------------------------------
Kai,
If I could make a recommendation, it would be to move your "if evt.component ==" evaluation to the top of the transform and add an "if evt.component" to the line, like so:
if evt.component and evt.component == 'name_of_component':
This does several things.
1. If an event coming into the event class doesn't have a component, the "if evt.component == 'name_of_component':" statement on its own will fail with a traceback as it's attempting to evaluate an evt attribute that doesn't exist. By adding an "existence check," the logic will only evaluate as True if evt.component is set on the event AND if it has your intended value. Note, you can do the same thing with Python's built-in getattr() function as it allows you to specify a default value. Going that route would look like: if getattr(evt, component, '') == 'name of component':
If evt.component exists, getattr() will use its value. If the component attribute is missing from the evt object, getattr() will use the default value of '' (empty string).
2. By moving this evaluation to the top of the transform, you skip the imports unless they're actually needed. This may only save you fractions of a second, but it's a good habit to get into especially for transforms on busy event classes.
If you've already tested your transforms and they're working the way you want, there's no need to make changes. If your system processes a large number of events and/or the transform is on a busy event class, these changes can make a difference over time.
------------------------------
Michael J. Rogers
Senior Instructor - Zenoss
Austin TX
------------------------------
| Subject: |
RE: Notification Scheduling |
| Author: |
Kai H |
| Posted: |
2020-12-03 17:27 |
Michael and Arthur,
Thanks so much for the suggestions! Michael, I definitely want the transform to handle null value tracebacks/errors. So, I went ahead and went with the following:
if evt.component and evt.component == 'name_of_component':
It appeared to be the most convenient option as I have a few transforms to modify (but not a lot). I also tested the change and the transform(s) appears to work just fine! Is it better practice to use the getattr() function? If so, I can go ahead and modify to use the function instead.
----------------------------------------------------------------------------------
Arthur, I also went with your recommendation and changed the time.localtime() value from [2] to [6]. I think I just stopped reading the value options when I saw the word "day." Lol. I think using the value for the day of the week is probably better practice.
Also, I attempted to specify the day on one line and the entire time range on the next line. Just like in your example and for some reason, I just cannot get it to work properly. I checked, double checked, and triple checked my syntax and indentions. Still cannot get it to work. So, I kept with my original idea and broke the time range out into 2 transforms. See the example below:
#Drop alerts for "name of component" on Monday >= 0 or 12am CST
if evt.component and evt.component == 'name of component':
import os
import time
os.environ['TZ'] = 'America/Chicago'
if time.localtime()[6] == 0 and time.localtime()[3] >= 0:
evt._action = 'drop'
#Drop alerts for name of component on Monday at < 12 or 12pm CST
if evt.component and evt.component == 'name of component':
import os
import time
os.environ['TZ'] = 'America/Chicago'
if time.localtime()[6] == 0 and time.localtime()[3] < 12:
evt._action = 'drop'
I tested by creating an event for the component both within a specified day/time range and outside of a day/time range. These transforms appear to work beautifully! It's all thanks to you guys! You guys are awesome....thank you!
------------------------------
Kai H
------------------------------
| Subject: |
RE: Notification Scheduling |
| Author: |
Michael Rogers |
| Posted: |
2020-12-03 21:12 |
Kai,
I'm glad to hear it's working for you! Also, kudos to Arthur and you both for all the work on this.
As to evt.component and evt.component == 'name_of_component' vs the getattr() approach, they both have pros and cons.
The "component and component ==" method is nice as it's obvious even to Python newbies (like me) what you're attempting to do. Also, for our very limited use case of "does the thing exist and does the thing equal x," it does the trick.
The getattr() approach is useful as it opens up additional possibilities. If your transform will be used to alter an event based on an event attribute, you can use the default value to plug in useful data instead of just protecting yourself from missing attributes. For example, an event generated by an SNMP trap may have any number of extra attributes decoded from the relevant MIB file. getattr() allows you to provide a backup value to the attribute should it be missing from your event. A transform like:
if evt.randomMibAttribute == "specific value":
evt.summary = evt.summary + evt.randomMibAttribute
Could instead be written:
if getattr(evt, randomMibAttribute, ", but no value was set for randomMibAttribute"):
evt.summary = evt.summary + evt.randomMibAttribute
In the first instance, a missing randomMibAttribute would result in a traceback. In the second, the same missing attribute would result in "This is a normal event summary, but no value was set for randomMibAttribute."
For component attributes with numeric values, you can use this to substitute a common value in the event that modeling didn't set the attribute.
------------------------------
Michael J. Rogers
Senior Instructor - Zenoss
Austin TX
------------------------------
| Subject: |
RE: Notification Scheduling |
| Author: |
Kai H |
| Posted: |
2020-12-08 11:15 |
Michael,
Thank you very much for the detailed explanation! I am going to go through some of my existing transforms and see if I can use the getattr() function as better practice. You and Arthur both have been extremely helpful. For both of you, I sincerely appreciate your time and assistance.
------------------------------
Kai H
------------------------------
| Subject: |
RE: Notification Scheduling |
| Author: |
Arthur |
| Posted: |
2020-12-09 14:50 |
Hi Kai
Great to hear that it s working. Also thank to Michael for his input which helps me too.
Wish you both all the best and take care.
------------------------------
Arthur
------------------------------
