We're working to monitor a couple of services with Zenoss over SNMP and have implemented the SNMP part. We have configured data sources (to various OIDs) and thresholds for these values and hosts to monitor.
For alerting rules, some of the data sources should be ignored/disabled at certain time intervals.
Our current idea is to : have an alerting rule for data source X with a certain schedule and have another alerting rule for data source Y (with different schedule).
Examining an event, the data source name seems to be included in event fields only at
- eventKey (eventKey being "data_source_name|data_source_name")
- dedupid (not included at Alerting Rule filter rule options)
Question : eventKey is included at the Alerting Rule filter options, so is it OK to use it for filtering or is there some more sensible option?
Alternatively, is it possible to use the performance template name for filtering? (I couldn't find it at the filtering options, at least)
In addition, does my approch sound sensible in general or is there a way to restrict certain data sources / thresholds to be active only at certain points of time?