Transforms - Suppress Events on Down Hosts
Warning: Making external calls (e.g. the calls in this example to zep.getEventSummaries) in Event transforms can have a very significant negative impact to your event throughput. Such calls should be avoided to the extent possible
This transform will suppress events that arrive due to a host going down but that are received before Zenoss has detected the host as being down. This is most offen seen with service checks that file while a host id on the way down but while a ping will still succeed. The code below will close any events with a count equal to one when the ping failure is received.
Bind this transform to the /Status/Ping event class.
from zenoss.protocols.protobufs.zep_pb2 import EventSummary from Products.ZenEvents.events2.proxy import EventSummaryProxy from zenoss.protocols.jsonformat import from_dict # When a host goes down, close existing events with a count of 1 (i.e. just happened when the host went down) if getattr(evt, 'severity', 0) > 0: zep = getFacade('zep') filter_zep = zep.createEventFilter(status=[0,1],element_identifier=dev.id,count_range=1) if zep.getEventSummaries(0,filter=filter_zep)['total'] > 0: for sum in zep.getEventSummariesGenerator(filter=filter_zep): newevt = EventSummaryProxy(from_dict(EventSummary, sum)) if getattr(newevt, 'eventClass', '/Unknown') != '/Status/Ping': evid_filter = zep.createEventFilter(uuid=[newevt.evid]) zep.closeEventSummaries(eventFilter=evid_filter, userName='admin')