Zenoss ZenTech Community

ok, I was recently tasked with a requirement to change the summary and message information for the critical event:

apparently, this was causing people to panic that the server was down when in reality in most cases there was a network issue which was causing the ping to fail, in addition they asked if I could update the eventKey to include an event number which is used by our ServiceNow system administrators when they get this event. So I decided to do this in a transform and I created the following:

import re
if device: evt.device = device.titleOrId()
match = re.search("is DOWN!", evt.summary)
if match:
evt.message = 'The ' + str(evt.device) + ' environment is not responding to ping requests and will be marked as down'
evt.eventKey ='75327'
evt.summary = 'Ping request to ' + str(evt.device) + ' failed, server is unreachable'

this works great with one exception. When the pings are successful again, the alarm does not clear and the device remains in a down state and does not collect any metrics until I manually clear this event. I use the same/similar type of transform on other event and do not have this problem. Any ideas Should I be doing this in a different way

Subject:	Ok, so you have some pretty
Author:	[Not Specified]
Posted:	2015-07-23 11:43

Ok, so you have some pretty unnecessary stuff in your transform, for instance you don't need to be using re to do a partial string match, it's much faster to use in. Also, this line "if device: evt.device = device.titleOrId()" is totally unnecessary since the Zenoss system automatically does that on the back-end as it processes the event anyways. Here is what the transform should look like...

Now, the reason why it's not clearing is simple. Since you're checking for "is DOWN!" and only applying to events that match that you're completely missing events that have "is UP!". Because of all the changes you're making to the events but not to the is UP! events, the matching that normally happens for clearing an event isn't able to complete. If you download the Zenoss Admin Guide and look at the Auto-Clear Correlation section in it, it explains this process in detail. In the case of these events, since there's no component present, it will check the following for the auto-clear in order...

device <--- This will match
component (can be blank) <---- This will match
eventKey (can be blank) <---- This will not match because you've changed it on the down event but not on the up event.
eventClass (including zEventClearClasses from event class configuration properties) <---- This will match.

So to really fix this you need the transform to look like this...

if "is DOWN!" in evt.summary:
evt.message = 'The %s environment is not responding to ping requests and will be marked as down' % (evt.device)
evt.eventKey = '75327'
evt.summary = 'Ping request to %s failed, server is unreachable' % (evt.device)
if "is UP!" in evt.summary:
evt.message = 'The %s environment is now responding to ping requests and will be marked as up' % (evt.device)
evt.eventKey = '75327'
evt.summary = 'Ping request to %s succeeded, server is reachable' % (evt.device)

That way the eventKey matches which will cause the auto-clear to work again.

Subject:	Thanks for the help.
Author:	[Not Specified]
Posted:	2015-07-23 14:07

Thanks for the help.

I am a bit of a python nooby. I was not able to get your tranform code to save so I am using the following code:

if "is DOWN!" in evt.summary:
evt.message = 'The ' + str(evt.device) + ' environment is not responding to ping requests and will be marked as down'
evt.summary = 'Ping request to '+ str(evt.device) + ' failed, server is unreachable'
evt.eventKey = '75327'
if "is UP!" in evt.summary:
evt.message = 'The ' + str(evt.device) + ' environment is now responding to ping requests and will be marked as up'
evt.eventKey = '75327'
evt.summary = 'Ping request to ' + str(evt.device) + ' succeeded, server is reachable'

it seems to work now.

John

Subject:	Zenoss transform on /status/ping not clearing
Author:	[Not Specified]
Posted:	2015-07-23 10:52

Zenoss transform on /status/ping not clearing