|
|
| Subject: | Configure Zenoss to ignore specific events |
| Author: | [Not Specified] |
| Posted: | 2014-11-25 09:51 |
I have spent the better part of the last few days trying to configure Zenoss to ignore a windows event logged in the event class of /Unknown. The event class key is "null", so I am unable to just click on the "Reclassify an event" button as I get an error stating "1 event does not have an event class key. Created 0 event mappings." I have read documentation recommended in this forum on how event classifications work in Zenoss and I have gone through many forums including this forum, but nothing has worked as recommended.
My goal is to figure out an easy way to get Zenoss to just ignore certain events. I have created an event class mapping under the event class /Ignore/Win. The mapping is called "Windows_Perfmon_Missing_Counters". I tried specifying "null" and "Windows_Perfmon_Missing_Counters" in the event class key of the mapping and neither made a difference. I tried the mapping with and without rule defined from using a regex for the event message or just typing in the event message exactly. I have tried a regex in regex that shows it matches the example of the event message I typed in example. I have tried all combinations of this including everything else I have found in my research and nothing will reclassify the event I want Zenoss to ignore.
Is there another way to approach this Does anyone have any suggestions There has to be an easy way to achieve just having Zenoss ignore a specific event message. Any help would be greatly appreciated.
I am using Zenoss Core 4.2.5 on RHEL 6.5. I have 3 windows servers added through WinRM monitoring. Everything else seems to be working fine.
| Subject: | Transform it |
| Author: | [Not Specified] |
| Posted: | 2014-11-25 09:54 |
Sounds like a job for a transform-- for instance:
if evt.message.find("Failed to collect some OIDs") >= 0:
evt._action = "drop"
I guess in your case you could put it in the /Unknown Event Class.
| Subject: | Transform |
| Author: | [Not Specified] |
| Posted: | 2014-11-25 13:53 |
Should I just click on Transform under the cog when under /Unknown or should I create a new mapping and put the transform code in the mapping under /Unknown Does it matter
| Subject: | If you're having trouble |
| Author: | [Not Specified] |
| Posted: | 2014-11-25 13:54 |
If you're having trouble remapping the events now, i don't see how creating a new mapping for the transform is going to help
| Subject: | I added the following |
| Author: | [Not Specified] |
| Posted: | 2014-11-25 14:26 |
I added the following transform directly to the event class /Unknown;
if evt.message.find("Windows Perfmon Missing Counters") >=0:
evt._action = "drop"
So far, it seems to stop the events from showing even the test events I added. Thanks for the help, this seems to at the least provide an easy way to drop unnecessary events.
| < |
Previous How to set criteria in one threshold for two datapoints |
Next Notifications - Ability to BCC? |
> |