How can I get event details in a transform with Zenoss 3.x

Question

I need to get the event details from a trap in an event transform.

The traps come with oids in the event details. The problem is that the OIDs are not predictable because the last digit is the event number on the SAN itself.

For example, the two oids listed were included in traps sent when I pulled disks from the array. This was for different disks, but the only differing numbers are 10000779 and 1419 which map to the event id on the SAN.

1.3.6.1.3.94.1.11.1.9.32.128.0.192.255.20.149.189.0.0.0.0.0.0.0.0.10000779 1.3.6.1.3.94.1.11.1.9.32.128.0.192.255.20.149.189.0.0.0.0.0.0.0.0.1419

I am able to dig down into the event details using zendmd and print out one of the values, but I can't seem to get the proper incantation in an event transform to work.

emgr = dmd.Events.getEventManager()
event = emgr.getEventDetail(dedupid='172.24.40.25||/Storage/SAN||4|snmp trap msaEventInfoTrap')
event.getEventDetails()
(('1.3.6.1.3.94.1.11.1.3.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.9999', '9999'), ('1.3.6.1.3.94.1.11.1.7.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.9999', '3'), ('1.3.6.1.3.94.1.11.1.9.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.9999', 'Event type: 312, Test SNMP trap, type HP StorageWorks P2000 G3 FC'), ('community', 'public'), ('oid', '1.3.6.1.4.1.11.2.51.0.3001'))
event.getEventDetails()[0][1]
'9999'
event.getEventDetails()[2][1]
'Event type: 312, Test SNMP trap, type HP StorageWorks P2000 G3 FC'

Things like evt.summary and evt.severity work in transforms, but evt.getEventDetails() does not.

Answer 1

Hi Nick,

       You need to create an EventClassMapping and add a rule. An in the Transform field you need to use

Variable1=getattr(evt,'1.3.6.1.3.94.1.11.1.9.32.128.0.192.255.20.149.189.0.0.0.0.0.0.0.0.10000779')

Variable2=getattr(evt,'1.3.6.1.3.94.1.11.1.9.32.128.0.192.255.20.149.189.0.0.0.0.0.0.0.0.1419')

evt.message = variable1 + ' ' + variable2
evt.summary = variable1 + ' ' + variable2
evt.severity=5 #Sets the severity to critical

Answer 2

-updated with simple example-

There is a fairly extensive guide on Event Enrichment.Org on this topic.

Note: the examples provided relate to Zenoss 4.2.

http://www.eventenrichment.org/enrich-zenoss-events-embedding-details/

The extreme cliff notes version: use the _map.keys() function in event transforms.

E.g.:

       for d in evt.details._map.keys():  
          if d == 'monitor.13.0':  
              query = evt.details.get(d)  
              evt.message = "The following query is taking longer than the allocated interval:\n" + query  
          if d == 'status.1.0':  
              evt.summary = evt.summary + ": " + evt.details.get(d)  
          if d == 'monitor.20.0':  
              evt.component = evt.details.get(d)  
          if d == 'monitor.8.0':  
             evt._action = 'history'   

Best,

-Ophir