Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've hooked up Zenoss' Zensyslog so that messages from a distributed list of client machines are all conglomerated into events on the Zenoss server. This is all fantastic, and I can bump messages by simply using the logger command:

logger -t webserver_is_down "The web server is down"

What I'd like to be able to do is also post an event that clears for when the webserver comes up.

logger -t webserver_is_up "The web server is up"

I've tried to set this up with Event classes but with no dice. Is there a Syslog level that correlates with Zenoss' clear/0 level? Is there another easy way to do this?

Thanks for any help you can give!

share|improve this question
Going to stick a bounty on this, as i've just ran into the same issue myself and google led me back here (d'oh!) – Sirex Nov 2 '12 at 0:31
As an aside, I personally tried "[clear] The web server is down", to no avail. – Sirex Nov 2 '12 at 3:24

Apparently, zenoss is unable to do this. :-( Essentially syslog is used for creating event, but these need to be manually closed.

You can alter severity (including close) based on content of the message, but mapping the new event to close a different event is non-trivial.

There are mappings between zensyylog levels and syslog levels, but none of these map to a zenoss event level of 0 (close). Hence, it is not possible to send a log message of "logger -p local6.debug" or similar and have that close an event with a matching message"

share|improve this answer

I think you can create an event mapping based on some rule or regex. Then, you'd code a transform for that mapping which would modify the event enough to become a clearing event: same dedup id as the event that should be cleared minus the severity which should be 0. If you cannot modify it enough, you can actually create a new event from the transform. This new event could clear the error for you. Mapping bonus: you can drop the event if it's useless to you

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.