Zenoss ZenTech Community

We are trying to tune our event correlation, because when a core network problem causes multiple events, we are buried in events and notifications. What is the mechanism that performs event correlation Can you please point me in the right direction for information on this and why it is not working According to the below datasheet, this is a built in feature Do we need to open a trouble ticket for this Or simply tune it correctly Please help, thanks.

Event correlation Automatic correlation of multiple events based on time and topologic relationships prevents event storms from overwhelming administrator consoles.

Subject:	Event Correlation is done via
Author:	Andrew Kirch
Posted:	2015-08-26 15:31

Event Correlation is done via Service Impact, part of the commercial product in a fairly automated manner. For your situation I would recommend: http://wiki.zenoss.org/Transforms_-_Suppress_hosts_behind_down_router

Andrew Kirch

akirch@gvit.com

Need Zenoss support, consulting or custom development Look no further. Email or PM me!

Ready for Distributed Topology (collectors) for Zenoss 5 Coming May 1st from GoVanguard

Subject:	Thanks Andrew, I have been
Author:	[Not Specified]
Posted:	2015-08-27 08:23

Thanks Andrew, I have been trying to get his transform to work for quite some time. It seems to only add in the notification that the upstream router is OK, but we are still getting buried in events and notifications. If this transform is implemented correctly, does this really suppress events down behind an upstream device

Subject:	if it doesn't you can
Author:	Andrew Kirch
Posted:	2015-08-27 14:10

if it doesn't you can certainly use that status check to do so using python.
Simply add evt._action = "drop" to the part of the if statement that determines that the router is down.

Subject:	Event Correlation
Author:	[Not Specified]
Posted:	2015-08-26 10:32