Send Events

Events can be sent to Zenoss through the UI but also through a programmatic interface. This how to will describe adding a device using that interface.

Using a REST call

Sending an event through a rest call can be done by a simple web get. In this example we will use wget to send an event. If you use wget don't for get to escape the "&" or wrap the URL in single quotes.

[zenos@zenoss $] wget 'http://admin:zenoss@MYHOST:8080/zport/dmd/ZenEventManager/manage_addEvent?device=MYDEVICE&component=MYCOMPONENT&summary=MYSUMMARY&severity=4&eclass=EVENTCLASS&eventClassKey=EVENTCLASSKEY

Using zensendevent

zensendevent is a handy little tool that should work on any system that has python available. It allows you to send an event to your Zenoss system and associate it with Device/Component.

zensendevent --device MYDEVICE --component DEVICECOMPONENT --classkey MYEVENTCLASSKET --severity Info|Debug|Clear|Error|Warning|Critical --class MYEVENTCLASS --server MYZENOSSSERVER --auth admin:zenoss (default)

Using XML-RPC

To send an event to zenoss using XML-RPC you will first need to create a dictionary (in perl a hash) that will represent the event. Zenoss will need at a minimum the following fields:

• device - the name of the device from which this event originates
• component - the sub-component of the device (for instance eth0, http, etc)
• summary - the text message of the event
• severity - an integer between 0 and 5 with higher numbers being higher severity. Zero is clear.

You can send an event to Zenoss via an interactive session with the python interpreter as follows:

>>> from xmlrpclib import ServerProxy
>>> serv = ServerProxy('http://admin:zenoss@MYHOST:8080/zport/dmd/ZenEventManager')
>>> evt = {'device':'mydevice', 'component':'eth0', 'summary':'eth0 is down','severity':4, 'eventClass':'/Net'}
>>> serv.sendEvent(evt)

See below for examples in other languages.

Event Database Dictionary

• dedupid - events will deduplicate based on the value of this field. by default: device, component, eventClass, eventKey, severity
• device - name of device
• component - name of component (like eth0, httpd, etc)
• eventClass - eventClass (if not specified maybe added by rule process if this failes will be /Unknown)
• eventKey - if a component needs further deduplication specification this field maybe used
• summary - message text truncated at 150 characters
• message - full message text
• severity - number from 0 to 5
• eventState - state of event 0 = new, 1 = acknowledged, 2 = suppressed
• eventClassKey - key by which rules processing begins. Often equal to component.
• eventGroup - logical group of event source (syslog, ping, nteventlog etc)
• stateChange - last time event changed automatically updated
• firstTime - unix timestamp when event is received.
• lastTime - last time an event was received
• count - number of times an event has repeated
• prodState - prodState of the device context
• suppid - id of event that suppressed this event
• manager - fqdn of the collector from which this event came
• agent - collector name from which event came (zensyslog, zentrap, etc)
• DeviceClass - device class from device context
• Location - device location from device context
• Systems - device systems from device context separated by |
• DeviceGroups - device systems from device context separated by |
• ipAddress - ip from which event came
• facility - syslog facility of this is syslog event
• priority - syslog priority of this is syslog event
• ntevid - nt event id if this is nt eventlog event.

Example Usage in Other Languages

Please note that we are a python shop and may not be able to answer specific questions about XML-RPC clients written in other languages.

Perl

Send an event via perl using RPC::XML::Client:

require RPC::XML;
require RPC::XML::Client;

$serv = RPC::XML::Client->new('http://YOURZENOSS:8081/');
%evt = ('device' => 'mydevice2', 'component' => 'eth1', 'summary' => 'eth1 is down', 'severity' => 4);
$args = RPC::XML::struct->new(%evt);
$serv->simple_request('sendEvent', $args);

Ruby

This is an example of an interactive ruby session (the returns have been omitted for the sake of clarity). Note, however, that the Ruby standard library is under active development in general, and specifically, the XML-RPC lib in Ruby is not stable. As of Feb 2007, there is a great deal of on-going discussion regarding XML-RPC in Ruby by Ruby developers and contributors. The following is known to work in previous versions of Ruby:

irb(main):001:0> require "xmlrpc/client"
irb(main):002:0> server = XMLRPC::Client.new2('user:pass@http://YOURZENOSS:8080/zport/dmd/DeviceLoader')
irb(main):003:0> evt = {'device' => 'mydevice3', 'component' => 'eth2', 'summary' => 'eth2 is down', 'severity' => 4}
irb(main):004:0> server.call('sendEvent', evt)

Java

I spent too much time trying to get a Java example running (using the lastest 3.x XML-RPC libs from Apache). Using their example as well as many I found on the net, I consistently got lots of errors, only some of which I was able to fix. I tried with Java 1.3, 1.4.2, and 1.5 -- all returned nearly identical results.

If someone can provide a modern, working example, we will post it here. But we don't have to time to figure this one out right now.