Transform - Issue

3 posts / 0 new
Last post
Nhoffee's picture
Last seen: 1 year 4 months ago
Joined: 11/23/2015 - 17:05
Posts: 2
Transform - Issue

Zenoss 5.0.8

So I am having an issue with Transforming my logs. I have a device on my network the comes in as an /unknown with ClassKey and Component as Null. I use the transform to add the ClassKey and Component names. After setting those items through a transform. I than try to Map the instance using those Keys.  I have played with setting the evt.eventClass property though the transform, the event still remains in the /Unknown event classes. 

import re

match ='note="INTERFACE STATISTICS"', evt.summary)

if match and device:

evt.eventClassKey = "firewall_stats"

evt.component = "Firewall"

# evt.eventClass = "/Firewall/USG50/statistics/"

Cannavarojo9's picture
Last seen: 2 weeks 6 days ago
Joined: 03/28/2017 - 23:31
Posts: 1
i have the same issue

i have the same issue

Jcurry's picture
Last seen: 3 days 7 hours ago
Joined: 01/02/2014 - 13:04
Posts: 407
The problem is that the

The problem is that the eventClassKey mapping is done BEFORE the transform.  You might like to pull my "Event Management for Zenoss Core 4" paper (  ) and look at the event life cycle diagram on page 26.

The event mapping process ONLY works if the eventClassKey field is filled in.  This means you will have to set the eventClass attribute in your transform, based on the logic you write to analyse the other event attributes.



Log in to post comments