Wednesday 11 August 2010

[zenoss] employ ping down dependency to suppress other events


sum = str(evt.summary)
if getattr(evt, 'severity', 0) > 0 \
and getattr(evt, 'eventClass', '/Unknown') != '/Status/Ping' \
and device and device.getPingStatus() > 0:
       evt._action = "drop"

if (sum.find("Command timed out")>=0) \
or (sum.find("Socket timeout")>=0) \
or (sum.find("Unable to read")>=0) \
or (sum.find("Process not running")>=0) \
or (sum.find("SNMP agent down")>=0) \
or (sum.find("No response from")>=0):
     if device.getPingStatus() <= 0:
           time.sleep(8)
           if device.getPingStatus() > 0:
                  evt._action = "drop"
     else:
           evt._action = "drop"

   if getattr(evt, 'prodState', 99)<400:
      evt._action = "drop"

11 comments:

  1. Great post. Using Zenoss 3.2, how do I use this? Where do I put it?

    ReplyDelete
  2. Matt, you put that code in the transform for all events at /Events

    ReplyDelete
  3. Where specifically should i place this code? Create New Event Class Mapping?

    ReplyDelete
  4. Your else statement is indented incorrectly. With the way you have it, if it sees the device up initially it's always going to drop it. The else should be part of the first if, not the second if. That way, if it immediately sees it down, it drops it, but if it sees it up it waits the 8 seconds, then if it sees it down it drops it otherwise it doesn't. Move the else statement out by 1 level.

    ReplyDelete
    Replies
    1. You are very right Ryan, that's how i actually set it up, but I guess this was a formatting error when I published this blog entry. I hope people who used it had noticed that. I have since corrected the entry.
      many thanks

      Delete
  5. This comment has been removed by the author.

    ReplyDelete
  6. This comment has been removed by the author.

    ReplyDelete
  7. For 3.x Zenoss, click on Events, Event Classes and then the BOTTOM LEFT there is a little gear. Click that and Transform.

    Thanks for the code. I have an MPLS network with about 5 routers, any way to get suppress the events from the devices behind them when they go down?

    ReplyDelete
  8. I just tried this on the new Zenoss 4.2 and it no longer works. :( Errors out.

    Problem with line 19: if getattr(evt, 'prodState', 99)<400:

    ReplyDelete