I'm new to Zenoss. About 1 week new. I have it up and running and receiving SNMP traps from our Bigip appliances. However, now I need to do something with them and am having trouble figuring out how to do classes and transforms right...
What I don't want is to click on each event that comes in and hit reclassify on it. that would take way to long. Instead, I'd like to say that all events coming in with the message "snmp trap bigip.*" or the event class key "bigip.*" (where .* is a regex meaning anything can come after) gets given the event class /sys/bigip. And then, any event in class /sys/bigip gets modified a bit. The bigip's will put the actual message in the "bigipNotifyObjMsg" field. I want that field to replace the message, summary, and be part of the deduplication logic. I also want to update the severity.
Is this doable? I've read through a bunch of the Zenoss documenation but a lot of it (at least the stuff google finds) relates to older versions of Zenoss and sets up transforms differently than the current version. So, how do I do this? I created the event class /sys/bigip. I then go to create a new mapping. I then go to edit the mapping, and am not sure what to use for "Event Class Key", Rule, Regex and transform for this to work.
I know this is probably simple stuff and answered before... google isn't helpful for this for some reason.