TECHZEN Zenoss User Community ARCHIVE  
FORUMS / Configuration & Administration / DISCUSSION

[Monitoring processes] zFailSeverity and count threshold in OSProcess template

Subject: [Monitoring processes] zFailSeverity and count threshold in OSProcess template
Author: Hrvoje T
Posted: 2019-05-08 05:14

Hi,

this just got me questioning. If you head to Infrastructure -> Processes and then pick any Process Class Name.
In the configuration you will find Failure Event Severity (zFailSeverity). Say it is set to Critical.

Here on the sam view, there is Minimum and Maximum Process Count Threshold. Say it is set to 1 and 20.
Then navigate to Advanced -> Monitoring Templates (make sure to set Group by: Template on the bottom). Find OSProcess in the templates tree. I'll refer to template bound to /Server/SSH/Linux. There is count threshold defined and it is using a call to methods for Minimum and Maximum Value. Those calls will return values 1 and 20 that we set earlier. Threshold severity is Warning.

My question is when process count drops to 0, will that trigger two events, one for zFailSeverty (with Critical event) and one for count threshold (with Warning event)?
I know I can expect the count threshold to trigger, that one is obvious. But what triggers zFailSeverity?

------------------------------
Hrvoje T
CS Computer Systems
Zagreb
------------------------------

Subject: RE: [Monitoring processes] zFailSeverity and count threshold in OSProcess template
Author: Jane Curry
Posted: 2019-05-08 09:31

Having just tested this out....

YES - if the count goes to 0 then you get 2 events, one for the process not running of class /Status/OSProcess and one for the threshold which no longer meets the max/min limits, of class /Perf/Snmp.  Each has it's own severity.  The 2 events are unrelated in the events system - unless you want to write something to relate them ;)

Cheers,
Jane

------------------------------
Jane Curry
Skills 1st United Kingdom
jane.curry@skills-1st.co.uk
------------------------------

Subject: RE: [Monitoring processes] zFailSeverity and count threshold in OSProcess template
Author: Hrvoje T
Posted: 2019-05-13 10:02

Thank you Jane, you are very helpful as usual. I guess I'll leave both but trigger notifications on only one of them.

I just checked my systems and got some events during the weekend. Yes, two pair of events are generated.
One is problem-clear pair with messages:
Problem:    Process set contains 0 running processes: wabk81
Clear:         Process up: wabk81 Using regex 'wabk81' with pid's 21319

Other is:
Problem:    threshold of count not met: current value 0.000000
Clear:         threshold of count restored: current value 1.000000

At first sight one would pick first one to trigger notifications but this one, at least on my side, is not quite complete. All fields in event details are empty (like zenoss.device.device_class, zenoss.device.groups, zenoss.device.ip_address, zenoss.device.location, zenoss.device.priority, zenoss.device.production_state). So I'm opting for threshold event as it is filled with all required information. Just a little transformation will do to make message look nicer. This is something for Zenoss to look up into, events triggered by zFailSeverity are missing some important fields (Zenoss 6.2.0 installed).


------------------------------
Hrvoje T
CS Computer Systems
Zagreb
------------------------------


< Previous
Zenoss runs for a while then quits responding 		  Next
EventClass Mapping for eventclasskeys With Special Characters 		>