---

Subject:	Read another thread and
Author:	[Not Specified]
Posted:	2015-11-09 09:35

Read another thread and notice it could be separated by the even transform, anybody could guide me for that Many thanks.

http://community.zenoss.org/message/73671#73671

Rgds,
Jacky

---

Subject:	Pull my Zenoss Event
Author:	Jane Curry
Posted:	2015-11-10 14:51

Pull my Zenoss Event Management paper from http://www.skills-1st.co.uk/papers/jane/zenoss4-events/ . There are some discussions in that about getting the trap varbinds to use in transforms.
Cheers,
Jane

Email: jane.curry@skills-1st.co.uk    Web: https://www.skills-1st.co.uk

---

Subject:	Hi Jane,
Author:	[Not Specified]
Posted:	2015-11-11 08:32

Hi Jane,

Thanks and I read section 9.6. However, when I create the event transform with the following statement. It seems cannot read all of the ifName or IfIndex detail or value.

forattrinevt.details._map.keys():
evt.message = evt.message + " @ " + attr

For example, there are three ifName and IfIndex in the event. It only returns one record of ifName and IfIndex from the evt.details._map.keys():

For my case, it is not necessary separate the event to different evid, however, I need to examine all ifIndex in the event. Do you have any idea about this. Million thanks.

Rgds,
Jacky

---

Subject:	Hi Jacky,
Author:	Jane Curry
Posted:	2015-11-15 12:21

Hi Jacky,
I started with the /Net/Link event class, copied the mapping transform from snmp_linkDown. I created a new class, /Net/Link/taplow-11 with a taplow-11 mapping with a rule for my test device saying device.id == 'taplow-11.skills-1st.co.uk' . Make sure the eventClassKey is still snmp_linkDown and set the sequence number so the test mapping has precedence over the original one. Then copy the transform from the original mapping to your test one.

I then added to the end of the transform to add all the event details attributes and values to evt.message (used message as summary only has 255 chars before it truncates.

if_index_str = getattr(evt.details, "ifIndex", None)

if if_index_str is not None and device is not None:

if_index = int(if_index_str)
for interface in device.os.interfaces():
if interface.ifindex == if_index:
evt.component = interface.id
for attr in evt.details._map.keys():
if attr.startswith('if'):
try:
evt.myFieldValue = 'attr is ' + attr + ' value is ' + evt.details.get(attr)
except:
evt.myFieldValue = 'except clause ' + join(list(evt.details.getAll(attr)))
continue
evt.message = evt.message + " " + evt.myFieldValue

break

Sorry - I know the whitespace is all screwed-up / non-existent. Really don't know how to preserve whitespace in this forum tool.

So the extra stuff starts at "for attr in evt.details._map.keys():"

It's not pretty or elegant but my evt.message has:

snmp trap snmp_linkDown attr is ifAdminStatus value is 1 attr is ifOperStatus.3 value is 2 attr is ifIndex.3 value is 3 attr is ifOperStatus value is 2 attr is ifIndex value is 3 attr is ifAdminStatus.3 value is 1

Does that help

Cheers,
Jane

Email: jane.curry@skills-1st.co.uk    Web: https://www.skills-1st.co.uk