Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need to get the event details from a trap in an event transform.

The traps come with oids in the event details. The problem is that the OIDs are not predictable because the last digit is the event number on the SAN itself.

For example, the two oids listed were included in traps sent when I pulled disks from the array. This was for different disks, but the only differing numbers are 10000779 and 1419 which map to the event id on the SAN.

1.3.6.1.3.94.1.11.1.9.32.128.0.192.255.20.149.189.0.0.0.0.0.0.0.0.10000779 1.3.6.1.3.94.1.11.1.9.32.128.0.192.255.20.149.189.0.0.0.0.0.0.0.0.1419

I am able to dig down into the event details using zendmd and print out one of the values, but I can't seem to get the proper incantation in an event transform to work.

emgr = dmd.Events.getEventManager()
event = emgr.getEventDetail(dedupid='172.24.40.25||/Storage/SAN||4|snmp trap msaEventInfoTrap')
event.getEventDetails()
(('1.3.6.1.3.94.1.11.1.3.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.9999', '9999'), ('1.3.6.1.3.94.1.11.1.7.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.9999', '3'), ('1.3.6.1.3.94.1.11.1.9.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.9999', 'Event type: 312, Test SNMP trap, type HP StorageWorks P2000 G3 FC'), ('community', 'public'), ('oid', '1.3.6.1.4.1.11.2.51.0.3001'))
event.getEventDetails()[0][1]
'9999'
event.getEventDetails()[2][1]
'Event type: 312, Test SNMP trap, type HP StorageWorks P2000 G3 FC'

Things like evt.summary and evt.severity work in transforms, but evt.getEventDetails() does not.

share|improve this question
add comment

2 Answers

Hi Nick,

       You need to create an EventClassMapping and add a rule. An in the Transform field you need to use

Variable1=getattr(evt,'1.3.6.1.3.94.1.11.1.9.32.128.0.192.255.20.149.189.0.0.0.0.0.0.0.0.10000779')

Variable2=getattr(evt,'1.3.6.1.3.94.1.11.1.9.32.128.0.192.255.20.149.189.0.0.0.0.0.0.0.0.1419')

evt.message = variable1 + ' ' + variable2
evt.summary = variable1 + ' ' + variable2
evt.severity=5 #Sets the severity to critical
share|improve this answer
add comment

-updated with simple example-

There is a fairly extensive guide on Event Enrichment.Org on this topic.

Note: the examples provided relate to Zenoss 4.2.

http://www.eventenrichment.org/enrich-zenoss-events-embedding-details/

The extreme cliff notes version: use the _map.keys() function in event transforms.

E.g.:

       for d in evt.details._map.keys():  
          if d == 'monitor.13.0':  
              query = evt.details.get(d)  
              evt.message = "The following query is taking longer than the allocated interval:\n" + query  
          if d == 'status.1.0':  
              evt.summary = evt.summary + ": " + evt.details.get(d)  
          if d == 'monitor.20.0':  
              evt.component = evt.details.get(d)  
          if d == 'monitor.8.0':  
             evt._action = 'history'   

Best,

-Ophir

share|improve this answer
1  
The answer should at least include the basics needed to answer the question. A link to an answer is not sufficient, since the link is likely to disappear. –  Fred the Magic Wonder Dog Mar 14 at 20:12
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.