Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to get the event details from a trap in an event transform.

The traps come with oids in the event details. The problem is that the OIDs are not predictable because the last digit is the event number on the SAN itself.

For example, the two oids listed were included in traps sent when I pulled disks from the array. This was for different disks, but the only differing numbers are 10000779 and 1419 which map to the event id on the SAN.

I am able to dig down into the event details using zendmd and print out one of the values, but I can't seem to get the proper incantation in an event transform to work.

emgr = dmd.Events.getEventManager()
event = emgr.getEventDetail(dedupid='||/Storage/SAN||4|snmp trap msaEventInfoTrap')
(('', '9999'), ('', '3'), ('', 'Event type: 312, Test SNMP trap, type HP StorageWorks P2000 G3 FC'), ('community', 'public'), ('oid', ''))
'Event type: 312, Test SNMP trap, type HP StorageWorks P2000 G3 FC'

Things like evt.summary and evt.severity work in transforms, but evt.getEventDetails() does not.

share|improve this question

Hi Nick,

       You need to create an EventClassMapping and add a rule. An in the Transform field you need to use



evt.message = variable1 + ' ' + variable2
evt.summary = variable1 + ' ' + variable2
evt.severity=5 #Sets the severity to critical
share|improve this answer

-updated with simple example-

There is a fairly extensive guide on Event Enrichment.Org on this topic.

Note: the examples provided relate to Zenoss 4.2.

The extreme cliff notes version: use the _map.keys() function in event transforms.


       for d in evt.details._map.keys():  
          if d == 'monitor.13.0':  
              query = evt.details.get(d)  
              evt.message = "The following query is taking longer than the allocated interval:\n" + query  
          if d == 'status.1.0':  
              evt.summary = evt.summary + ": " + evt.details.get(d)  
          if d == 'monitor.20.0':  
              evt.component = evt.details.get(d)  
          if d == 'monitor.8.0':  
             evt._action = 'history'   



share|improve this answer
The answer should at least include the basics needed to answer the question. A link to an answer is not sufficient, since the link is likely to disappear. – Fred the Magic Wonder Dog Mar 14 '14 at 20:12

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.