Looking at the documentation and the GUI the only thing I can give groups permission to (that I can use to influence what events they can see) are deviceclasses. Personally, I would like to see a request for enhancement here so that I can permission on event class as well. That would be a great feature.
Given that I can only use deviceClasses for permissioning (I plan to have multiple groups each with access to different events) I looked at playing with transforms to influence the DeviceClasses. I learned a few things:
* First, you can't set the DeviceClass in an event transform. It lets you do it, and shows it as changed, but it will always put the event in the same deviceclass that the device the event is from comes to. I tested this by setting the deviceclass to an abitrary class in my tree and the event didn't appear in the proper class.
* Second, the only way to influence the deviceclass is to create devices in the infrastucture view. The events will follow where that device lives. This forces me into a model where Zenoss wants to probe the devices for status. I don't want to use zenoss for that. I want to use it as a trap and event receiver and not as a probe. As I add more and more devices into my network, a central zenoss server does not scale as well as a distributed model where the devices with issues tell zenoss their problems. AT MOST, all I want Zenoss to do is make sure the device is still alive (right now I have Nagios configured for that).
* Third, only my admin user can add devices. Apparently when I add a device as an LDAP user it ignores the device and doesn't create a task for it.
So, back to the questions...
* Why can't my LDAP users see events in the events view, but CAN see events in the Infrastructure view? Is this a Zenoss Core limitation or something with LDAP permissions?
* What is the best way to configure this?
I would love any and all feedback from people. I'm leveraging the forums to encourage communication, but the only person responding has the same issue as me and no solutions on how to move forward either... Is there a better way to raise issues with the Zenoss developers?
Thanks,
Scott