Transforms - Suppress Events on Down Hosts

From Zenoss Wiki
This is the approved revision of this page, as well as being the most recent.
Jump to: navigation, search

Warning: Making external calls (e.g. the calls in this example to zep.getEventSummaries) in Event transforms can have a very significant negative impact to your event throughput. Such calls should be avoided to the extent possible

This transform will suppress events that arrive due to a host going down but that are received before Zenoss has detected the host as being down. This is most offen seen with service checks that file while a host id on the way down but while a ping will still succeed. The code below will close any events with a count equal to one when the ping failure is received.

Bind this transform to the /Status/Ping event class.

 from zenoss.protocols.protobufs.zep_pb2 import EventSummary
 from Products.ZenEvents.events2.proxy import EventSummaryProxy
 from zenoss.protocols.jsonformat import from_dict
 # When a host goes down, close existing events with a count of 1 (i.e. just happened when the host went down)
 if getattr(evt, 'severity', 0) > 0:
   zep = getFacade('zep')
   filter_zep = zep.createEventFilter(status=[0,1],element_identifier=dev.id,count_range=1)
   if zep.getEventSummaries(0,filter=filter_zep)['total'] > 0:
     for sum in zep.getEventSummariesGenerator(filter=filter_zep):
       newevt = EventSummaryProxy(from_dict(EventSummary, sum))
       if getattr(newevt, 'eventClass', '/Unknown') != '/Status/Ping':
         evid_filter = zep.createEventFilter(uuid=[newevt.evid])
         zep.closeEventSummaries(eventFilter=evid_filter, userName='admin')