Zenoss ZenTech Community

Hi Team,
I am working on creating a transformation to receive a Trap from a NNMI management tool and assign it to an event class.
.54254 > .snmptrap: [udp sum ok] { SNMPv2c { V2Trap(1253) R=0 .1.3.6.1.2.1.1.3.0=31523 .1.3.6.1.6.3.1.1.4.1.0=.1.3.6.1.4.1.11.2.17.19.2.0.64 .1.3.6.1.4.1.11.2.17.19.2.2.1="NNMi" .1.3.6.1.4.1.11.2.17.19.2.2.2="NNMI" .1.3.6.1.4.1.11.2.17.19.2.2.3=1 .1.3.6.1.4.1.11.2.17.19.2.2.4= .1.3.6.1.4.1.11.2.17.19.2.2.5="NnmHealthOverallStatus" .1.3.6.1.4.1.11.2.17.19.2.2.6="2df65a66-f8a6-4480-8d78-475127f2b313" .1.3.6.1.4.1.11.2.17.19.2.2.7="com.hp.nms.incident.category.Alert" .1.3.6.1.4.1.11.2.17.19.2.2.8="com.hp.nms.incident.family.NnmHealth" .1.3.6.1.4.1.11.2.17.19.2.2.9="MANAGEMENTSOFTWARE" .1.3.6.1.4.1.11.2.17.19.2.2.10=1 .1.3.6.1.4.1.11.2.17.19.2.2.11="NNMi health status is now at Normal" .1.3.6.1.4.1.11.2.17.19.2.2.12=1 .1.3.6.1.4.1.11.2.17.19.2.2.13=5 .1.3.6.1.4.1.11.2.17.19.2.2.14=1 .1.3.6.1.4.1.11.2.17.19.2.2.15="20150724192228422+0530" .1.3.6.1.4.1.11.2.17.19.2.2.16="20150724192238390+0530" .1.3.6.1.4.1.11.2.17.19.2.2.17="20150724192238390+0530" .1.3.6.1.4.1.11.2.17.19.2.2.18=0 .1.3.6.1.4.1.11.2.17.19.2.2.19= .1.3.6.1.4.1.11.2.17.19.2.2.20="nnm.health.details= " .1.3.6.1.4.1.11.2.17.19.2.2.21="blr-mdc-001.contoso.com" .1.3.6.1.4.1.11.2.17.19.2.2.22="" .1.3.6.1.4.1.11.2.17.19.2.2.23= .1.3.6.1.4.1.11.2.17.19.2.2.24= .1.3.6.1.4.1.11.2.17.19.2.2.25="blr-mdc-001.contoso.com" .1.3.6.1.4.1.11.2.17.19.2.2.26="com.hp.ov.nms.model.core.ConfigurationItem" .1.3.6.1.4.1.11.2.17.19.2.2.27="f67550ac-3483-4581-91fe-badad41a0f2c" .1.3.6.1.4.1.11.2.17.19.2.2.28= .1.3.6.1.4.1.11.2.17.19.2.2.29= .1.3.6.1.4.1.11.2.17.19.2.2.30= .1.3.6.1.4.1.11.2.17.19.2.2.31= .1.3.6.1.4.1.11.2.17.19.2.2.32= .1.3.6.1.4.1.11.2.17.19.2.2.33= .1.3.6.1.4.1.11.2.17.19.2.2.34= .1.3.6.1.4.1.11.2.17.19.2.2.35= .1.3.6.1.4.1.11.2.17.19.2.2.36= .1.3.6.1.4.1.11.2.17.19.2.2.37= .1.3.6.1.4.1.11.2.17.19.2.2.38= .1.3.6.1.4.1.11.2.17.19.2.2.39= .1.3.6.1.4.1.11.2.17.19.2.2.40= .1.3.6.1.4.1.11.2.17.19.2.2.41= .1.3.6.1.4.1.11.2.17.19.2.2.42= } }

I have a created an event class NNMI and NNMIAlerts, so its /Events/NNMI/NNMIAlerts so within NNMIAlerts i have created a event class mapping as nnmiTraps.
Within this eventclass mapping i have created a rule as below:

and applied simple transform to get attributes of OID and put a debug to print it in event.log file.

Based on the trap I am receiving, I expect the rule to work and assign the alert to this event class. However this trap is being alerted on /Unknown event class and its obvious i cant see log printed to pick OID.
Please let me know whats the issue here.

Subject:	grab the event and transform
Author:	Andrew Kirch
Posted:	2015-07-24 15:57

grab the event and transform it to the class you're wanting. http://wiki.zenoss.org/Category:Transforms

Andrew Kirch

akirch@gvit.com

Need Zenoss support, consulting or custom development Look no further. Email or PM me!

Ready for Distributed Topology (collectors) for Zenoss 5 Coming May 1st from GoVanguard

Subject:	Hi Andrew,
Author:	[Not Specified]
Posted:	2015-07-29 08:44

Hi Andrew,

I checked, seems none of these rules are gabbing traps and assigning the event class.

getattr(evt,'oid').startswith(('1.3.6.1.4.1.11.2.17.19.2'))

getattr(evt,'oid','').startswith(('1.3.6.1.4.1.11.2.17.19.2'))

All are faining any pointers.

Subject:	For starters, is there a MIB
Author:	Jane Curry
Posted:	2015-07-30 09:17

For starters, is there a MIB available that describes these TRAPs If so, you might start by importing that in to Zenoss as it will at least help decode the ASN.1 numerical gobbledegook into some basic words. If the MIB is imported, it will probably change your transform as you will probably find that the OID starts with enterprises. - in other words, some translation will occur.

The next question is your version of Zenoss. With Zenoss 3.x then your code may work but with Zenoss 4 and later the structure of the event fields changed. Grab my Event Management paper from http://www.skills-1st.co.uk/papers/jane/zenoss4-events/ and have a look around page 104 for examples decoding TRAP varbind event attributes.

Cheers,
Jane

Email: jane.curry@skills-1st.co.uk Web: https://www.skills-1st.co.uk

Subject:	Hi Jane,
Author:	[Not Specified]
Posted:	2015-08-11 05:20

Hi Jane,

Thank you for your help, I managed that to get worked by defining the eventclass key as defaultmapping. But although i am not testing any tarps to match this condition all times i can see my zenevend.log filled with below message every 5 minutes without me testing this rule. Could you please let me know what could be the reason.

2015-08-11 15:44:47,901 WARNING root: EventClassInst: /NNMI/NNMIAlerts/NnmiTraps rule failure: oid
2015-08-11 15:44:56,249 INFO zen.maintenance: Performing periodic maintenance
2015-08-11 15:44:58,072 WARNING root: EventClassInst: /NNMI/NNMIAlerts/NnmiTraps rule failure: oid
2015-08-11 15:45:56,252 INFO zen.maintenance: Performing periodic maintenance
2015-08-11 15:46:56,258 INFO zen.maintenance: Performing periodic maintenance
2015-08-11 15:47:18,037 WARNING root: EventClassInst: /NNMI/NNMIAlerts/NnmiTraps rule failure: oid
2015-08-11 15:47:56,265 INFO zen.maintenance: Performing periodic maintenance
2015-08-11 15:48:08,078 WARNING root: EventClassInst: /NNMI/NNMIAlerts/NnmiTraps rule failure: oid

Thank you,

Subject:	Event Class mapping not working as expected.
Author:	[Not Specified]
Posted:	2015-07-24 09:19

Event Class mapping not working as expected.