|
|
| Subject: | Transform - Issue |
| Author: | [Not Specified] |
| Posted: | 2015-12-03 16:10 |
Zenoss 5.0.8
So I am having an issue with Transforming my logs. I have a device on my network the comes in as an /unknown with ClassKey and Component as Null. I use the transform to add the ClassKey and Component names. After setting those items through a transform. I than try to Map the instance using those Keys. I have played with setting the evt.eventClass property though the transform, the event still remains in the /Unknown event classes.
import re
match = re.search('note="INTERFACE STATISTICS"', evt.summary)
if match and device:
evt.eventClassKey = "firewall_stats"
evt.component = "Firewall"
# evt.eventClass = "/Firewall/USG50/statistics/"
| Subject: | i have the same issue |
| Author: | [Not Specified] |
| Posted: | 2017-03-28 23:37 |
i have the same issue
| Subject: | The problem is that the |
| Author: | Jane Curry |
| Posted: | 2017-04-11 04:45 |
The problem is that the eventClassKey mapping is done BEFORE the transform. You might like to pull my "Event Management for Zenoss Core 4" paper ( https://www.skills-1st.co.uk/papers/jane/zenoss4-events/ ) and look at the event life cycle diagram on page 26.
The event mapping process ONLY works if the eventClassKey field is filled in. This means you will have to set the eventClass attribute in your transform, based on the logic you write to analyse the other event attributes.
Cheers,
Jane
Email: jane.curry@skills-1st.co.uk Web: https://www.skills-1st.co.uk
| < |
Previous Dashboard view filtering where has it gone |
Next Integration with telegram |
> |