---

Subject:	That's normal. There should
Author:	Jan Garaj
Posted:	2015-09-01 15:56

That's normal. There should be device variable available - see examples http://wiki.zenoss.org/Event_Transforms_and_Examples

Devops Monitoring Expert advice: Dockerize/automate/monitor all the things.

DevOps stack: Docker / Kubernetes / Mesos / Zabbix / Zenoss / Grafana / Puppet / Ansible / Vagrant / Terraform / Elasticsearch

---

Subject:	Missing something
Author:	[Not Specified]
Posted:	2015-09-01 16:28

I may be missing something as I still cannot get any movement.

I've tried the following transform in the /Perf/Memory Event Class mappings for defaultmapping and also created another mapping called MemoryClass.

Example Transform:
import re
match = re.search('threshold of Memory*', evt.message)
if match and device:
evt.eventClassKey = "MemoryClass"

I'm sure there is just one small piece I am missing and any help is appreciated.

---

Subject:	You regular expression might
Author:	Jim R
Posted:	2015-09-02 10:37

You regular expression might be off, you probably want it to be 'threshold of Memory.*'.

Are you trying to drop the event based on something about specific devices, or something more general

---

Subject:	Plan for transform
Author:	[Not Specified]
Posted:	2015-09-02 11:42

Yes jregovic, I have 3 memory events that trigger at 20%, 10%, and 5% thresholds. Some of our servers run MS SQL so they out of the gate they trigger the 20% and 10% threshold. The plan is to drop those events for select devices.

I also made the suggested adjustment to the transform and am still not having any luck.

import re
match = re.search('threshold of Memory.*', evt.message)
if match and device:
evt.message = 'test - ' + evt.message
evt.eventClassKey = 'MemoryClass'

Thanks for the suggestions so far; please keep them coming.

---

Subject:	You may just be better off
Author:	Jim R
Posted:	2015-09-02 13:31

You may just be better off creating separate device classes with different thresholds.

My standard practice would be to create a sub-device class and create a new template with new thresholds. Longterm, it will be easier to maintain that way with fewer events for zeneventd to process.

Are you seeing any errors in zeneventd.log or event.log
You may also see errors in the event console with "Error processing transform" in the summary .