1

I have a monitoring template set up on Zenoss to run a database query and use Nagios to check that the output of the query, which is a number, is within an acceptable range. When it's not, a CRITICAL level event is generated.

My question is: How can I make this monitoring template also generate a CLEAR level event when the output of the query is within the acceptable range. By doing this, any previously generated CRITICAL level events would be automatically closed once the device is running normally again.

Zak
  • 113
  • 5

1 Answers1

1

You need to use event transforms in the eventClass where the event is getting transformed and use de-duplication.

De-dupid is a combination of

device | component | eventKey | eventClass | severity

For Example Blade 7 pulled out from chassis 10.2.3.4 eventClass is /Hardware dedupid will be

10.2.3.4 | Blade 7 | Blade_Key | /Hardware | 3 [3 means warning]

To clear the event all the field should be same except the severity

10.2.3.4 | Blade 7 | Blade_Key | /Hardware | 0 [0 is clear]

Event Tales Attributes

check the link

ZVIK
  • 535
  • 3
  • 11