Thanks James, the way you described the ruleset, worked fine.
The reason for configuring it the other way around simply was 'not knowing
better' and this seemed to be the cause of my problem.
So this is the working setting:
2coll.rs:
Event Stream -> Query Database Collection -> Forward
block ID Source: Origin
Collection: Hubs
Forward: Contained in Collection
Thanks and regards...Andreas
-----Original Message-----
From: James Shanks [mailto:James_Shanks AT TIVOLI DOT COM]
Sent: Dienstag, November 16, 1999 13:28
To: NV-L AT UCSBVM.ucsb DOT edu
Subject: Re: Collections in Ruleset
Well, I am not sure why you did it this way, but you have given nvcorrd and
nvevents a lot of work to do.
Why set the initial node to pass when in fact you want to remove most of the
events?
Why not start off with block and the Forward only those you want to see? By
using the negative case "Forward if not in collection" and then "resolve"
you
have effectively doubled or tripled the amount of cpu necessary to do this.
But
whether that is at the root of your problem I cannot say. The other way,
with
block, forward if in collection, and finally Forward, is much neater and I
have
used it many times.
To find out why your ruleset is not working will require that you issue
nvcdebug -d all while it is running and examine the nvcorrd.alog. You
should
see the query collection being resolved as either True or False and if
False,
then there will be a message as to why.
James Shanks
Tivoli (NetView for UNIX) L3 Support
Kuffer Andreas <Andreas.Kuffer AT KUONI DOT CH> on 11/16/99 06:33:26 AM
Please respond to Discussion of IBM NetView and POLYCENTER Manager on
NetView
<NV-L AT UCSBVM.UCSB DOT EDU>
To: NV-L AT UCSBVM.UCSB DOT EDU
cc: (bcc: James Shanks/Tivoli Systems)
Subject: Collections in Ruleset
hi there
I'm running AIX 4.3.2 and NetView 5.1.2. I defined a collection Hubs
(isHub=TRUE) and would like to use this collection for getting out events
only from this collection. Therefore I defined a simple ruleset named
2coll.rs:
Event Stream -> Query Database Collection -> Resolve
pass ID Source: Origin
Collection: Hubs
Forward: Not Contained in Collection
Now I do create a dynamic workspace named hubevents with correlation rule
2coll.rs. Events are coming in from hubs but also from other machines,
definitely being no hubs (isHub = FALSE) and not being member of the
Hubs-collection.
Am I doing anything wrong? Anyone also had problems on this? Are there other
ways to get events only from objects being part of a collection?
Any comments are more than welcome...Andreas
Thanks James, the way you described the ruleset, worked fine.
The reason for configuring it the other way around simply was 'not knowing better' and this seemed to be the cause of my problem.
So this is the working setting:
2coll.rs:
Event Stream -> Query Database Collection -> Forward
block ID Source: Origin
Collection: Hubs
Forward: Contained in Collection
Thanks and regards...Andreas
-----Original Message-----
From: James Shanks [mailto:James_Shanks AT TIVOLI DOT COM]
Sent: Dienstag, November 16, 1999 13:28
To: NV-L AT UCSBVM.ucsb DOT edu
Subject: Re: Collections in Ruleset
Well, I am not sure why you did it this way, but you have given nvcorrd and
nvevents a lot of work to do.
Why set the initial node to pass when in fact you want to remove most of the
events?
Why not start off with block and the Forward only those you want to see? By
using the negative case "Forward if not in collection" and then "resolve" you
have effectively doubled or tripled the amount of cpu necessary to do this. But
whether that is at the root of your problem I cannot say. The other way, with
block, forward if in collection, and finally Forward, is much neater and I have
used it many times.
To find out why your ruleset is not working will require that you issue
nvcdebug -d all while it is running and examine the nvcorrd.alog. You should
see the query collection being resolved as either True or False and if False,
then there will be a message as to why.
James Shanks
Tivoli (NetView for UNIX) L3 Support
Kuffer Andreas <Andreas.Kuffer AT KUONI DOT CH> on 11/16/99 06:33:26 AM
Please respond to Discussion of IBM NetView and POLYCENTER Manager on NetView
<NV-L AT UCSBVM.UCSB DOT EDU>
To: NV-L AT UCSBVM.UCSB DOT EDU
cc: (bcc: James Shanks/Tivoli Systems)
Subject: Collections in Ruleset
hi there
I'm running AIX 4.3.2 and NetView 5.1.2. I defined a collection Hubs
(isHub=TRUE) and would like to use this collection for getting out events
only from this collection. Therefore I defined a simple ruleset named
2coll.rs:
Event Stream -> Query Database Collection -> Resolve
pass ID Source: Origin
Collection: Hubs
Forward: Not Contained in Collection
Now I do create a dynamic workspace named hubevents with correlation rule
2coll.rs. Events are coming in from hubs but also from other machines,
definitely being no hubs (isHub = FALSE) and not being member of the
Hubs-collection.
Am I doing anything wrong? Anyone also had problems on this? Are there other
ways to get events only from objects being part of a collection?
Any comments are more than welcome...Andreas
|