| Subject: |
RE: EventClass Mapping for eventclasskeys With Special Characters |
| Author: |
Jane Curry |
| Posted: |
2019-05-06 06:24 |
I think you have the correct understanding, Dan. Let me preface my comments by saying I have done test on Zenoss 4.2.5 - but I suspect it is behaving exactly the same way as yours.
You are quite correct that the event class mapping must match the event class key field exactly for that mapping to match. My tests showed that with the leading "." the mapping worked and could be seen in the event detail, but any customisation - whether using config properties or a transform, simply failed to happen. Remove the leading "." on the eventClassKey and the customisation worked. I was using zensendevent to generate test events like:
zensendevent -d win_test -s Error -k ".NET Runtime_1023" -o ntevid=1022 .NET Runtime version 2.0.50727.8669 - Failed to CoCreate profiler.
So I tried creating an event subclass under /Win - WinDiscard. Under this subclass, I created an identical event class mapping. The mapping worked AND the customisation worked - both with Config properties and with a transform. You can obviously have lots of different mappings under your /Win/WinDiscard subclass. You may also need to check the Sequence configuration if an event can match several classes and/or subclasses to ensure the correct class mapping is evaluated first.
Hope that works for you.
Cheers,
Jane
------------------------------
Jane Curry
Skills 1st United Kingdom
jane.curry@skills-1st.co.uk
------------------------------
| Subject: |
RE: EventClass Mapping for eventclasskeys With Special Characters |
| Author: |
Jay Stanley |
| Posted: |
2019-05-09 07:54 |
The restriction on some special characters has been fixed in 6.3.2.
If you are running an older version, you can get around it by creating a mapping without the special character, then use an API call to change it
Example payload
[
{
"action": "EventClassesRouter",
"method": "editInstance",
"data": [
{
"params": {
"evclass": "/zport/dmd/Events/CiscoUCS/Fault",
"uid": "/zport/dmd/Events/CiscoUCS/Fault/instances/F0479",
"instanceName": "F0479",
"newName": "F0479",
"eventClassKey": "ucs|F0479",
"example": "",
"explanation": "",
"regex": "",
"rule": "(getattr(evt, 'ucs-code', '') == 'F0479' or getattr(evt, 'eventClassKey', '') == 'ucs|F0479')",
"resolution": "",
"transform": ""
}
}
],
"type": "rpc",
"tid": 1
}
]------------------------------
jstanley
------------------------------
