Configuration & Administration

Expand all | Collapse all

Notification Scheduling

  • 1.  Notification Scheduling

    Posted 10-28-2020 03:34 PM

    Hello All!

    I have a question(s) regarding the notification scheduling feature. We make extensive use of the trigger/notification features on a normal basis. However, I was asked to schedule a notification for everyday "except" Mondays from 12am - 8am. I noticed that the scheduling options are not very granular. Is there a way to schedule a notification such as the one I outlined above? I am new to notification scheduling so I apologize in advance if this question is remedial.

    Just a bit of background of the Zenoss environment. This is an on-prem Zenoss 6.4.1 system. It is completely virtualized in a vSphere environment. We have 2 delegate systems running Resource Manager and a master running Control Center 1.6.5

    Thanks to all for your time!

    ------------------------------
    Kai H
    ------------------------------


  • 2.  RE: Notification Scheduling

    Posted 10-29-2020 01:54 AM
    Maybe it's not the best solution, however you can still drop or lower the severity of the events within a transform during that period.
    If you still need the events and just want to disable the notification, that's indeed a bit more difficult.

    ------------------------------
    Laurent Hemeryck
    Monitoring Engineer
    FedNot
    ------------------------------



  • 3.  RE: Notification Scheduling

    Posted 10-29-2020 08:48 AM
    Laurent,

    Thank you very much for the recommendation. I also thought about that solution. However, I am uncertain as to what a transform would look like with a specific day/time. Would you happen to know the syntax and provide an example? Thanks again....I really appreciate your suggestion.

    ------------------------------
    Kai H
    ------------------------------



  • 4.  RE: Notification Scheduling

    Posted 10-30-2020 03:54 PM
    Hi Kai

    See here, transform based on time.

    ------------------------------
    Arthur
    ------------------------------



  • 5.  RE: Notification Scheduling

    Posted 11-02-2020 11:54 AM
    Arthur,

    Thank you very much for the information! This is very helpful!

    Just one more question. Does anyone know if this transform can be used for a component instead of a device? We want to suppress alerts for a specific component within a device. I'm thinking that I should be able to use evt.component == "component name": instead of evt.device == "device name": but that is just an assumption. Thanks again Arthur for providing such helpful information.

    ------------------------------
    Kai H
    ------------------------------



  • 6.  RE: Notification Scheduling

    Posted 11-17-2020 12:30 PM
    Hi Kai

    Yep, evt.component should work.
    See here

    Arthur

    ------------------------------
    Arthur
    ------------------------------



  • 7.  RE: Notification Scheduling

    Posted 11-30-2020 11:49 AM
    Arthur,

    Thank you so much for the info. I was able to create a transform with the link you provided. I have one more inquiry to make (I promise). My transform writing is a bit rusty. I was hoping that you would be able to take a quick look at the transform below and confirm that it is written correctly:

    #Drop alerts for "name of component" on Monday from 12am - 12pm
    import os
    import time
    os.environ['TZ'] = 'America/Chicago'
    if evt.component == 'name_of_component':
    if time.localtime()[2] == 0:
    if time.localtime()[3] >= 0 and time.localtime()[3] < 12:
    evt._action = 'drop'

    So as you can see, I would like to have all generated events for this component to be dropped every Monday from 12am to 12pm. Does the above look like the proper syntax?

    I promise that this is my last question!! Lol. Again, thank you very much for your help!

    ------------------------------
    Kai H
    ------------------------------



  • 8.  RE: Notification Scheduling

    Posted 12-02-2020 10:02 AM
    Arthur,

    I actually figured out what I was doing wrong. Instead of this:

    #Drop alerts for "name of component" on Monday from 12am - 12pm
    import os
    import time
    os.environ['TZ'] = 'America/Chicago'
    if evt.component == 'name_of_component':
    if time.localtime()[2] == 0:
    if time.localtime()[3] >= 0 and time.localtime()[3] < 12:
    evt._action = 'drop'

    I broke the time range out into 2 different groups and created the following transforms:

    #Drop alerts for name_of_component on Monday >= 0 or 12am
    import os
    import time
    os.environ['TZ'] = 'America/Chicago'
    if evt.component == 'name_of_component':
    if time.localtime()[2] == 0 and time.localtime()[3] >= 0:
    evt._action = 'drop'

    #Drop alerts for name_of_component on Monday at < 12 or 12pm
    import os
    import time
    os.environ['TZ'] = 'America/Chicago'
    if evt.component == 'name_of_component':
    if time.localtime()[2] == 0 and time.localtime()[3] < 12:
    evt._action = 'drop'

    I tested these transforms and they appear to work perfectly. I thought I would give examples of the code just in case anyone else has the same question/issue. Again, thanks so much Arthur! Your recommendations worked perfectly!

    ------------------------------
    Kai H
    ------------------------------



  • 9.  RE: Notification Scheduling

    Posted 12-02-2020 10:42 AM

    Kai,

    If I could make a recommendation, it would be to move your "if evt.component ==" evaluation to the top of the transform and add an "if evt.component" to the line, like so:

    if evt.component and evt.component == 'name_of_component':

    This does several things.

    1. If an event coming into the event class doesn't have a component, the "if evt.component == 'name_of_component':" statement on its own will fail with a traceback as it's attempting to evaluate an evt attribute that doesn't exist.  By adding an "existence check," the logic will only evaluate as True if evt.component is set on the event AND if it has your intended value.  Note, you can do the same thing with Python's built-in getattr() function as it allows you to specify a default value.  Going that route would look like:  if getattr(evt, component, '') == 'name of component':

    If evt.component exists, getattr() will use its value.  If the component attribute is missing from the evt object, getattr() will use the default value of '' (empty string).

    2. By moving this evaluation to the top of the transform, you skip the imports unless they're actually needed.  This may only save you fractions of a second, but it's a good habit to get into especially for transforms on busy event classes.

    If you've already tested your transforms and they're working the way you want, there's no need to make changes.  If your system processes a large number of events and/or the transform is on a busy event class, these changes can make a difference over time.



    ------------------------------
    Michael J. Rogers
    Senior Instructor - Zenoss
    Austin TX
    ------------------------------



  • 10.  RE: Notification Scheduling

    Posted 12-02-2020 04:17 PM
    Edited by Arthur 12-02-2020 05:24 PM
    Hi Kai

    Here is my proposal. It hopefully takes the hint from Michael into accout as we should not run in a stake trace if the component is missing.
    In addition I used the time.localtime()[6] function to get the day of the week. Any how if your transform is working ok that fine too.

    Identation is important!

    #Drop alerts for "name of component" each Monday from 00:00 - 12:00 CET

    if evt.component and evt.component == 'name_of_component':
      import re
      import os
      import time

      os.environ['TZ'] = 'Europe/Zurich'

      if time.localtime()[6] == 0:
        if time.localtime()[3] >= 0 and time.localtime()[3] < 12:
          evt._action = 'drop'


    P.S. Sorry for the delay but I was a bit busy and thanks Michael for his appreciated input. I have to go over my transforms now :-)

    ------------------------------
    Arthur
    ------------------------------



  • 11.  RE: Notification Scheduling

    Posted 12-03-2020 04:27 PM
    Michael and Arthur,

    Thanks so much for the suggestions! Michael, I definitely want the transform to handle null value tracebacks/errors. So, I went ahead and went with the following:

    if evt.component and evt.component == 'name_of_component':

    It appeared to be the most convenient option as I have a few transforms to modify (but not a lot). I also tested the change and the transform(s) appears to work just fine! Is it better practice to use the getattr() function? If so, I can go ahead and modify to use the function instead.

    ----------------------------------------------------------------------------------

    Arthur, I also went with your recommendation and changed the time.localtime() value from [2] to [6]. I think I just stopped reading the value options when I saw the word "day." Lol. I think using the value for the day of the week is probably better practice.

    Also, I attempted to specify the day on one line and the entire time range on the next line. Just like in your example and for some reason, I just cannot get it to work properly. I checked, double checked, and triple checked my syntax and indentions. Still cannot get it to work. So, I kept with my original idea and broke the time range out into 2 transforms. See the example below:

    #Drop alerts for "name of component" on Monday >= 0 or 12am CST
    if evt.component and evt.component == 'name of component':
      import os
      import time
      os.environ['TZ'] = 'America/Chicago'
      if time.localtime()[6] == 0 and time.localtime()[3] >= 0:
        evt._action = 'drop'

    #Drop alerts for name of component on Monday at < 12 or 12pm CST
    if evt.component and evt.component == 'name of component':
      import os
      import time
      os.environ['TZ'] = 'America/Chicago'
      if time.localtime()[6] == 0 and time.localtime()[3] < 12:
        evt._action = 'drop'

    I tested by creating an event for the component both within a specified day/time range and outside of a day/time range. These transforms appear to work beautifully! It's all thanks to you guys! You guys are awesome....thank you!







    ------------------------------
    Kai H
    ------------------------------



  • 12.  RE: Notification Scheduling

    Posted 12-03-2020 08:12 PM

    Kai,

    I'm glad to hear it's working for you!  Also, kudos to Arthur and you both for all the work on this.

    As to evt.component and evt.component == 'name_of_component' vs the getattr() approach, they both have pros and cons.

    The "component and component ==" method is nice as it's obvious even to Python newbies (like me) what you're attempting to do.  Also, for our very limited use case of "does the thing exist and does the thing equal x," it does the trick.

    The getattr() approach is useful as it opens up additional possibilities.  If your transform will be used to alter an event based on an event attribute, you can use the default value to plug in useful data instead of just protecting yourself from missing attributes.  For example, an event generated by an SNMP trap may have any number of extra attributes decoded from the relevant MIB file.  getattr() allows you to provide a backup value to the attribute should it be missing from your event.  A transform like:

    if evt.randomMibAttribute == "specific value":
        evt.summary = evt.summary + evt.randomMibAttribute

    Could instead be written:

    if getattr(evt, randomMibAttribute, ", but no value was set for randomMibAttribute"):
        evt.summary = evt.summary + evt.randomMibAttribute

    In the first instance, a missing randomMibAttribute would result in a traceback.  In the second, the same missing attribute would result in "This is a normal event summary, but no value was set for randomMibAttribute."

    For component attributes with numeric values, you can use this to substitute a common value in the event that modeling didn't set the attribute.



    ------------------------------
    Michael J. Rogers
    Senior Instructor - Zenoss
    Austin TX
    ------------------------------



  • 13.  RE: Notification Scheduling

    Posted 12-08-2020 10:15 AM
    Michael,

    Thank you very much for the detailed explanation! I am going to go through some of my existing transforms and see if I can use the getattr() function as better practice. You and Arthur both have been extremely helpful. For both of you, I sincerely appreciate your time and assistance.

    ------------------------------
    Kai H
    ------------------------------



  • 14.  RE: Notification Scheduling

    Posted 12-09-2020 01:50 PM
    Hi Kai

    Great to hear that it s working. Also thank to Michael for his input which helps me too.

    Wish you both all the best and take care.

    ------------------------------
    Arthur
    ------------------------------



  • 15.  RE: Notification Scheduling

    Posted 11-02-2020 11:44 AM
    Edited by Michael 11-02-2020 11:44 AM
    Kai,

    You can set up a notification schedule that repeats weekly, something like this:


    For the duration, I did the following:

    1 week = 60 minutes x 24 hours/day x 7 days/week = ​10080
    Midnight to 0800 = 8 hours x 60 minutes = 480
    1 week - Midnight to 0800 = 10080 - 480 = 9600

    So, the notification "window" will open at 8AM Monday morning and run all week long until the following Monday at midnight.

    You could still do a time-based transform to alter the event severity or drop it entirely, but this has the side effect of altering your events.  Using the notification scheduler, your events remain intact for better record keeping and forensics.

    I hope this helps!

    ------------------------------
    Michael J. Rogers
    Senior Instructor - Zenoss
    Austin TX
    ------------------------------