Zenoss ZenTech Community

I'm new to Zenoss and wanted to know howto use a transform to get vcenter event messages to deduplicate correctly. I need the deduplication to occur based on text in the event summary. At the moment, I get an event that says in the summary "Zerto: Alert turned on at ". The clearing of this event would be a 2nd event message that says in the summary "Zerto: Alert turned off at " where is the same text. So I get 2 new events in Zenoss, instead of 2nd message causing clearance of 1st message. I need Zenoss to recognize that because the is the same in both messages, then the "Zerto: Alert turned off" part of the summary is saying the event has cleared.

Subject:	Hi Richard - welcome to
Author:	Jane Curry
Posted:	2015-12-16 12:38

Hi Richard - welcome to Zenoss!

You might want to pull my paper on Event Management for Zenoss from http://www.skills-1st.co.uk/papers/jane/zenoss4-events/ . There's a lot in there but pages 31 - 33 describe the duplicate "fingerprint" and also the "auto-clear fingerprint".

It's not quite straightforward as the fingerprint consists of the device, component, eventClass, eventKey and severity fields. (Note eventKey, not eventClassKey). If the eventKey is null then the summary field also becomes part of the duplicate fingerprint.

The fingerprint is constructed at the end of the event processing pipeline so you can use event transforms to change any of these fields if you wish. Some people write transforms to set the eventKey field so that deduplication no longer relies on the summary field matching.

You might find some help on the wiki under the Transforms category - http://wiki.zenoss.org/Category:Transforms .

Cheers,

Jane

Email: jane.curry@skills-1st.co.uk Web: https://www.skills-1st.co.uk

Subject:	Create a dedupid from event summary
Author:	[Not Specified]
Posted:	2015-12-15 11:55

Create a dedupid from event summary