Configuration & Administration

Kai,

If I could make a recommendation, it would be to move your "if evt.component ==" evaluation to the top of the transform and add an "if evt.component" to the line, like so:

if evt.component and evt.component == 'name_of_component':

This does several things.

1. If an event coming into the event class doesn't have a component, the "if evt.component == 'name_of_component':" statement on its own will fail with a traceback as it's attempting to evaluate an evt attribute that doesn't exist.  By adding an "existence check," the logic will only evaluate as True if evt.component is set on the event AND if it has your intended value.  Note, you can do the same thing with Python's built-in getattr() function as it allows you to specify a default value.  Going that route would look like:  if getattr(evt, component, '') == 'name of component':

If evt.component exists, getattr() will use its value.  If the component attribute is missing from the evt object, getattr() will use the default value of '' (empty string).

2. By moving this evaluation to the top of the transform, you skip the imports unless they're actually needed.  This may only save you fractions of a second, but it's a good habit to get into especially for transforms on busy event classes.

If you've already tested your transforms and they're working the way you want, there's no need to make changes.  If your system processes a large number of events and/or the transform is on a busy event class, these changes can make a difference over time.

------------------------------
Michael J. Rogers
Senior Instructor - Zenoss
Austin TX

Original Message:
Sent: 12-02-2020 10:02 AM
From: Kai H
Subject: Notification Scheduling

Arthur,

I actually figured out what I was doing wrong. Instead of this:

#Drop alerts for "name of component" on Monday from 12am - 12pm
import os
import time
os.environ['TZ'] = 'America/Chicago'
if evt.component == 'name_of_component':
if time.localtime()[2] == 0:
if time.localtime()[3] >= 0 and time.localtime()[3] < 12:
evt._action = 'drop'

I broke the time range out into 2 different groups and created the following transforms:

#Drop alerts for name_of_component on Monday >= 0 or 12am
import os
import time
os.environ['TZ'] = 'America/Chicago'
if evt.component == 'name_of_component':
if time.localtime()[2] == 0 and time.localtime()[3] >= 0:
evt._action = 'drop'

#Drop alerts for name_of_component on Monday at < 12 or 12pm
import os
import time
os.environ['TZ'] = 'America/Chicago'
if evt.component == 'name_of_component':
if time.localtime()[2] == 0 and time.localtime()[3] < 12:
evt._action = 'drop'

I tested these transforms and they appear to work perfectly. I thought I would give examples of the code just in case anyone else has the same question/issue. Again, thanks so much Arthur! Your recommendations worked perfectly!

------------------------------
Kai H

Original Message:
Sent: 11-17-2020 12:30 PM
From: Arthur
Subject: Notification Scheduling

Hi Kai

Yep, evt.component should work.
See here

Arthur

------------------------------
Arthur

Original Message:
Sent: 11-02-2020 11:53 AM
From: Kai H
Subject: Notification Scheduling

Arthur,

Thank you very much for the information! This is very helpful!

Just one more question. Does anyone know if this transform can be used for a component instead of a device? We want to suppress alerts for a specific component within a device. I'm thinking that I should be able to use evt.component == "component name": instead of evt.device == "device name": but that is just an assumption. Thanks again Arthur for providing such helpful information.

------------------------------
Kai H

Original Message:
Sent: 10-30-2020 03:53 PM
From: Arthur
Subject: Notification Scheduling

Hi Kai

See here, transform based on time.

------------------------------
Arthur

Original Message:
Sent: 10-29-2020 08:48 AM
From: Kai H
Subject: Notification Scheduling

Laurent,

Thank you very much for the recommendation. I also thought about that solution. However, I am uncertain as to what a transform would look like with a specific day/time. Would you happen to know the syntax and provide an example? Thanks again....I really appreciate your suggestion.

------------------------------
Kai H

Original Message:
Sent: 10-29-2020 01:54 AM
From: Laurent Hemeryck
Subject: Notification Scheduling

Maybe it's not the best solution, however you can still drop or lower the severity of the events within a transform during that period.
If you still need the events and just want to disable the notification, that's indeed a bit more difficult.

------------------------------
Laurent Hemeryck
Monitoring Engineer
FedNot

Original Message:
Sent: 10-28-2020 03:33 PM
From: Kai H
Subject: Notification Scheduling


Hello All!

I have a question(s) regarding the notification scheduling feature. We make extensive use of the trigger/notification features on a normal basis. However, I was asked to schedule a notification for everyday "except" Mondays from 12am - 8am. I noticed that the scheduling options are not very granular. Is there a way to schedule a notification such as the one I outlined above? I am new to notification scheduling so I apologize in advance if this question is remedial.

Just a bit of background of the Zenoss environment. This is an on-prem Zenoss 6.4.1 system. It is completely virtualized in a vSphere environment. We have 2 delegate systems running Resource Manager and a master running Control Center 1.6.5

Thanks to all for your time!

------------------------------
Kai H
------------------------------

Kai,

If I could make a recommendation, it would be to move your "if evt.component ==" evaluation to the top of the transform and add an "if evt.component" to the line, like so:

if evt.component and evt.component == 'name_of_component':

This does several things.

1. If an event coming into the event class doesn't have a component, the "if evt.component == 'name_of_component':" statement on its own will fail with a traceback as it's attempting to evaluate an evt attribute that doesn't exist.  By adding an "existence check," the logic will only evaluate as True if evt.component is set on the event AND if it has your intended value.  Note, you can do the same thing with Python's built-in getattr() function as it allows you to specify a default value.  Going that route would look like:  if getattr(evt, component, '') == 'name of component':

If evt.component exists, getattr() will use its value.  If the component attribute is missing from the evt object, getattr() will use the default value of '' (empty string).

2. By moving this evaluation to the top of the transform, you skip the imports unless they're actually needed.  This may only save you fractions of a second, but it's a good habit to get into especially for transforms on busy event classes.

If you've already tested your transforms and they're working the way you want, there's no need to make changes.  If your system processes a large number of events and/or the transform is on a busy event class, these changes can make a difference over time.

Kai,

If I could make a recommendation, it would be to move your "if evt.component ==" evaluation to the top of the transform and add an "if evt.component" to the line, like so:

if evt.component and evt.component == 'name_of_component':

This does several things.

1. If an event coming into the event class doesn't have a component, the "if evt.component == 'name_of_component':" statement on its own will fail with a traceback as it's attempting to evaluate an evt attribute that doesn't exist.  By adding an "existence check," the logic will only evaluate as True if evt.component is set on the event AND if it has your intended value.  Note, you can do the same thing with Python's built-in getattr() function as it allows you to specify a default value.  Going that route would look like:  if getattr(evt, component, '') == 'name of component':

If evt.component exists, getattr() will use its value.  If the component attribute is missing from the evt object, getattr() will use the default value of '' (empty string).

2. By moving this evaluation to the top of the transform, you skip the imports unless they're actually needed.  This may only save you fractions of a second, but it's a good habit to get into especially for transforms on busy event classes.

If you've already tested your transforms and they're working the way you want, there's no need to make changes.  If your system processes a large number of events and/or the transform is on a busy event class, these changes can make a difference over time.

Kai,

I'm glad to hear it's working for you!  Also, kudos to Arthur and you both for all the work on this.

As to evt.component and evt.component == 'name_of_component' vs the getattr() approach, they both have pros and cons.

The "component and component ==" method is nice as it's obvious even to Python newbies (like me) what you're attempting to do.  Also, for our very limited use case of "does the thing exist and does the thing equal x," it does the trick.

The getattr() approach is useful as it opens up additional possibilities.  If your transform will be used to alter an event based on an event attribute, you can use the default value to plug in useful data instead of just protecting yourself from missing attributes.  For example, an event generated by an SNMP trap may have any number of extra attributes decoded from the relevant MIB file.  getattr() allows you to provide a backup value to the attribute should it be missing from your event.  A transform like:

if evt.randomMibAttribute == "specific value":
    evt.summary = evt.summary + evt.randomMibAttribute

Could instead be written:

if getattr(evt, randomMibAttribute, ", but no value was set for randomMibAttribute"):
    evt.summary = evt.summary + evt.randomMibAttribute

In the first instance, a missing randomMibAttribute would result in a traceback.  In the second, the same missing attribute would result in "This is a normal event summary, but no value was set for randomMibAttribute."

For component attributes with numeric values, you can use this to substitute a common value in the event that modeling didn't set the attribute.

Kai,

If I could make a recommendation, it would be to move your "if evt.component ==" evaluation to the top of the transform and add an "if evt.component" to the line, like so:

if evt.component and evt.component == 'name_of_component':

This does several things.

1. If an event coming into the event class doesn't have a component, the "if evt.component == 'name_of_component':" statement on its own will fail with a traceback as it's attempting to evaluate an evt attribute that doesn't exist.  By adding an "existence check," the logic will only evaluate as True if evt.component is set on the event AND if it has your intended value.  Note, you can do the same thing with Python's built-in getattr() function as it allows you to specify a default value.  Going that route would look like:  if getattr(evt, component, '') == 'name of component':

If evt.component exists, getattr() will use its value.  If the component attribute is missing from the evt object, getattr() will use the default value of '' (empty string).

2. By moving this evaluation to the top of the transform, you skip the imports unless they're actually needed.  This may only save you fractions of a second, but it's a good habit to get into especially for transforms on busy event classes.

If you've already tested your transforms and they're working the way you want, there's no need to make changes.  If your system processes a large number of events and/or the transform is on a busy event class, these changes can make a difference over time.

Kai,

I'm glad to hear it's working for you!  Also, kudos to Arthur and you both for all the work on this.

As to evt.component and evt.component == 'name_of_component' vs the getattr() approach, they both have pros and cons.

The "component and component ==" method is nice as it's obvious even to Python newbies (like me) what you're attempting to do.  Also, for our very limited use case of "does the thing exist and does the thing equal x," it does the trick.

The getattr() approach is useful as it opens up additional possibilities.  If your transform will be used to alter an event based on an event attribute, you can use the default value to plug in useful data instead of just protecting yourself from missing attributes.  For example, an event generated by an SNMP trap may have any number of extra attributes decoded from the relevant MIB file.  getattr() allows you to provide a backup value to the attribute should it be missing from your event.  A transform like:

if evt.randomMibAttribute == "specific value":
    evt.summary = evt.summary + evt.randomMibAttribute

Could instead be written:

if getattr(evt, randomMibAttribute, ", but no value was set for randomMibAttribute"):
    evt.summary = evt.summary + evt.randomMibAttribute

In the first instance, a missing randomMibAttribute would result in a traceback.  In the second, the same missing attribute would result in "This is a normal event summary, but no value was set for randomMibAttribute."

For component attributes with numeric values, you can use this to substitute a common value in the event that modeling didn't set the attribute.

Kai,

If I could make a recommendation, it would be to move your "if evt.component ==" evaluation to the top of the transform and add an "if evt.component" to the line, like so:

if evt.component and evt.component == 'name_of_component':

This does several things.

1. If an event coming into the event class doesn't have a component, the "if evt.component == 'name_of_component':" statement on its own will fail with a traceback as it's attempting to evaluate an evt attribute that doesn't exist.  By adding an "existence check," the logic will only evaluate as True if evt.component is set on the event AND if it has your intended value.  Note, you can do the same thing with Python's built-in getattr() function as it allows you to specify a default value.  Going that route would look like:  if getattr(evt, component, '') == 'name of component':

If evt.component exists, getattr() will use its value.  If the component attribute is missing from the evt object, getattr() will use the default value of '' (empty string).

2. By moving this evaluation to the top of the transform, you skip the imports unless they're actually needed.  This may only save you fractions of a second, but it's a good habit to get into especially for transforms on busy event classes.

If you've already tested your transforms and they're working the way you want, there's no need to make changes.  If your system processes a large number of events and/or the transform is on a busy event class, these changes can make a difference over time.