You can use Zenoss to create multiple event class mappings that can correlate two events and create an action based on the occurrence of the two events. An example would be creating a correlation such as the beginning of a failure with the end of a failure so that the clear event and then automatically move the event to the history database.
-
Navigate to one of the event classes you want to correlate.
Click the Mappings tab. Create an additional mapping.
-
Click on the Classes tab again, then click on the mapping you just created, then click on its Edit tab.
-
Set Event Class Key back to the event class you want to correlate.
-
Make any changes to the Event Mapping fields you want such as adding the text “totally broken” in the Regex field.
-
Make a second mapping in the same class with a related name to the first so you know its correlated with the first mapping.
-
Set the Event Class Key the same event class key you set for the above event mapping.
-
Make any changes to the Event Mapping fields you want such as adding the text “everything is ok” in the Regex field.
-
Go to the zProperties tab and set zEventSeverity to Clear (in the case where you want the 2nd event to create a clear correlation). When this mapping matches the event will become a clear event and will clear all active events of the same class.
-
Once this is done, go to the “Sequence” tab and notice that all three mappings with the same event class key are listed here.
-
The order will control how the mappings are applied. Our first mapping will apply to all events with the given event class key and will prevent our new rules from becoming active.
-
Put this mapping at the end of the sequence by changing its sequence number to 3 and clicking Save.
Zenoss News