Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We're working to monitor a couple of services with Zenoss over SNMP and have implemented the SNMP part. We have configured data sources (to various OIDs) and thresholds for these values and hosts to monitor.

For alerting rules, some of the data sources should be ignored/disabled at certain time intervals.

Our current idea is to : have an alerting rule for data source X with a certain schedule and have another alerting rule for data source Y (with different schedule).

Examining an event, the data source name seems to be included in event fields only at

  • eventKey (eventKey being "data_source_name|data_source_name")
  • dedupid (not included at Alerting Rule filter rule options)

Question : eventKey is included at the Alerting Rule filter options, so is it OK to use it for filtering or is there some more sensible option?

Alternatively, is it possible to use the performance template name for filtering? (I couldn't find it at the filtering options, at least)

In addition, does my approch sound sensible in general or is there a way to restrict certain data sources / thresholds to be active only at certain points of time?

br, Touko

share|improve this question
up vote 1 down vote accepted

I think event key is the way to work with this, at least we haven't found any better option.

Schedules with alerting rules seem to be a bit more problematic but that's another story. Some details can be found at Zenoss Forums : Alerts rules with active periods

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.