Class transforms for /Unknown don't work

[zenoss]

Description

• Zenoss Version: Stack build 2.2.0 -> 2.2.4
• Operating System(s): SuSE 10.3
• Regression (Y/N): N

Steps to Reproduce

1. Create an event class transform on the /Unknown event class. Go to the /Unknown event class and choose More ->Transform from its menu. Transform was:

if evt.agent == "zentrap"

evt.summary="gotcha"

2. Doesn't work with an SNMP event
3. Also tried modifying zProperties for /Unknown (changing severity and/or drop to history). No works. 4.I find any modifications to the /Unknown event class transform don't "take" with the Save button. I've had to either recycle all the Zenoss daemons or, using zendmd, use:

dmd.Events.reIndex()
commit()

You can see what the database thinks is in the transform with:
for ec in dmd.Events.getSubOrganizers():

if ec.transform:

print ec, ec.getOrganizerName(), ec.transform

After a reIndex it gets the changes; before it doesn't

5. To make sure my transform isn't buggy, I have cut and paste it into an event class mapping for a different Event Class - it works fine there.
6. Also tried changing my /Unknown transform to a single line that changes evt.summary. If I test with the AddEvent dropdown and just specify message, device and class then the transform works but it does NOT transform any "real" events coming in with the /Unknown class.

Results

Transforms on /Unknown class don't work

Expected Results

Impact

Important

Notes

Jane Curry
jane.curry@…
Phone: +44 1628 782565

[zenoss]

On further investigation, I think this problem is more pervasive. I have just tried to create a transform for a totally different event class MAPPING. Eventually reduced the transform to
evt.summary="blah" and, on Save, the transform stayed red.

Regressed to an earlier VMware snapshot of this machine (before messing with /Unknown class transform) and the same mapping transform works fine.

I have a nasty suspicion that my events database may be somewhat fubar! Is there any way to prove this??

Cheers,
Jane