Event Management for Zenoss Core 4 January 2013 Jane Curry Skills 1st Ltd www.skills-1st.co.uk Jane Curry Skills 1st Ltd 2 Cedar Chase Taplow Maidenhead SL6 0EU 01628 782565
[email protected] www.skills-1st.co.uk Synopsis This paper is intended as an intermediate-level discussion of the Zenoss event system in Zenoss Core 4. The event architecture has changed dramatically in Zenoss 4 from previous versions. It is assumed that the reader is already familiar with the Zenoss Event Console and with basic navigation around the Zenoss Graphical User Interface (GUI). It looks in some detail at the architecture behind the Zenoss event system ± the daemons and how they are inter-related ± and it looks at the structure of a Zenoss event and the event life cycle. Zenoss can receive events from many sources in addition to Zenoss itself. Events from Windows, Unix syslogs and Simple Networks Management Protocol (SNMP) TRAPs are all examined in detail. The process by which an incoming event is converted into a particular Zenoss event is known as event mapping and there are a number of different possible techniques for performing that conversion. These will all be explored along with the creation of new event classes. Once an event has been received, classified and stored by Zenoss, automation may be required. Alerting to users by email and page is discussed, as are background actions to run commands or generate TRAPs. Logging and debugging techniques are discussed in some details as is the JSON API for extracting data out of Zenoss.