Other than the fact that I believe Event Class Key should be defaultmapping
(as in, all lowercase), You are correct.
jeopardyracing wrote:
> So to be sure I understand all the steps:
>
> Windows event viewer events are coming in to /unkown with only an OID in the
> summary field. I would like for them to be mapped to a class of my choice
> such as /win/eventvwr. Therefore:
>
> 1) create /win/eventvwr
>
> 2) in /win/eventvwr
>
> 3) in /win/eventvwr create a mapping of an arbitrary name, and then only have
> the following in the following fields of the mapping:
>
> Event Class Key = DefaultMapping
>
> Rule = evt.ClassKey.startswith('1.3.6.1.4.1.311.1.13')
>
> Transform = evt.summary = getattr(evt, "1.3.6.1.4.1.311.1.13.1.9999.1.0")
>
> Now when events come in they should be mapped to /win/eventvwr and I should
> see the details in the summary field.
>
> do I have that correct?
-------------------- m2f --------------------
Read this topic online here:
http://community.zenoss.com/forums/viewtopic.php?p=24605#24605
-------------------- m2f --------------------
_______________________________________________
zenoss-users mailing list
[email protected]
http://lists.zenoss.org/mailman/listinfo/zenoss-users
