Configuration & Administration

Expand all | Collapse all

Help with event transform

  • 1.  Help with event transform

    Posted 09-13-2018 07:16 PM

    I am trying to write an event transform for the following situation:

    I have an SNMP trap that comes in, and when looking in the details, I see the following fields

    I would like to write an event transform that looks like the following

    if str (getattr(evt, ""))=='LINK':
     evt.summary = "Interface state change-" + str (getattr(evt, ""))

    My problem is that the number at the end of the "clogHistFacility" and "clogHistMsgText" fields varies, so I need to be able to match a wildcard for the above transform like "clogHistFacility.*" and "clogHistMsgText.*". Each time the trap occurs, the number increments by one.

    This is for trying to alert on an SNMP trap for a link up/down on a Cisco switch

    How do I indicate/match the last xxx numeric part of the field in a transform? I don't know if I need to use regex somehow, or if there is a much easier way.

    Thanks for the help!

    anon anon

  • 2.  RE: Help with event transform

    Posted 09-14-2018 12:52 PM
    Hey, I got this working via the below transform

    for detail in evt.details._map.keys():
      if detail.startswith('clogHistFacility'):
    HistFacility = getattr(evt, detail)
      if detail.startswith('clogHistMsgText'):
    HistMsgText = getattr(evt, detail)

    if HistFacility=="LINK":
      evt.summary = "Interface state change-" + HistMsgText

    anon anon

  • 3.  RE: Help with event transform

    Posted 09-14-2018 01:26 PM
    Excellent! Sorry - saw your append this morning and then it got manic :(

    You might pull the Event Management paper that I wrote if you are looking for more examples in the future -  .


    Jane Curry
    Skills 1st United Kingdom