Ah, Oops.
your rule should be:
Code:
evt.eventClassKey.startswith('1.3.6.1.4.1.311.1.13')
nv wrote:
> Other than the fact that I believe Event Class Key should be defaultmapping
> (as in, all lowercase), You are correct.
>
>
> jeopardyracing wrote:
> > So to be sure I understand all the steps:
> >
> > Windows event viewer events are coming in to /unkown with only an OID in
> > the summary field. I would like for them to be mapped to a class of my
> > choice such as /win/eventvwr. Therefore:
> >
> > 1) create /win/eventvwr
> >
> > 2) in /win/eventvwr
> >
> > 3) in /win/eventvwr create a mapping of an arbitrary name, and then only
> > have the following in the following fields of the mapping:
> >
> > Event Class Key = DefaultMapping
> >
> > Rule = evt.ClassKey.startswith('1.3.6.1.4.1.311.1.13')
> >
> > Transform = evt.summary = getattr(evt, "1.3.6.1.4.1.311.1.13.1.9999.1.0")
> >
> > Now when events come in they should be mapped to /win/eventvwr and I should
> > see the details in the summary field.
> >
> > do I have that correct?
>
-------------------- m2f --------------------
Read this topic online here:
http://community.zenoss.com/forums/viewtopic.php?p=24606#24606
-------------------- m2f --------------------
_______________________________________________
zenoss-users mailing list
[email protected]
http://lists.zenoss.org/mailman/listinfo/zenoss-users
