event process filtering script - catch and break event parameter

Started by amitayb, May 21, 2020, 11:22:41 AM

Previous topic - Next topic

amitayb

Hi,
I catch an event using EPP.
I need to catch the event first parameter and regex it to catch relevant data from it.
that create new event where my catched data should be a parameter - will use as event key.

any idea how shold I implement it?
I saw this example:
$event->parameters[1] == %1

in my case: the param is: bigipNotifyObjMsg = SNMP_TRAP: Virtual /Common/WEBCMSTEST_VIP-HTTPS has become unavailable
I need to catch "/Common/WEBCMSTEST_VIP-HTTPS" and create new event from it.

I assume event filter is the way.
how can I test the results?
whats the best way to do it?
any examples?

Victor Kirhenshtein

Hi,

for event generation you can use PostEvent function. You can put everything into your filter script, but this seems a bit illogical, or create a script action. I would create a rule that matches event and executes script action. Inside that script (either filter script or action script) you can use something like this:


if ($event->parameters[1] ~= "^SNMP_TRAP: Virtual (.*) has become unavailable")
{
   PostEvent($node, "CUSTOM_EVENT", null, $1);
}


This will generate new event named CUSTOM_EVENT with path extracted from original event passed as first parameter.

Best regards,
Victor