From: Kent Allison@IBMAU on 03/12/99 21:09


To:   NV-L AT UCSBVM.UCSB DOT EDU
cc:
Subject:  Re:

Hi Uwe,

Thanks for pointing me in the right direction!  The answer, as they
sometimes do, turned out to be deceptively simple - it just took me all day
to reach the point where my tired brain finally made the quantum leap to
put 2 and 2 together to make 4!

Instead of using Variable $4, it is simpler to use $3. $3 is the message
text string for the Interface down event.  It has the form "Interface
interface_description Down.". So event attribute 3.2 (the 2nd blank
delimited word in attribute 3) can be matched against say "Loopback0" in an
Event Attribute block in a ruleset.  This then allows me to distinguish
interface down events from different interface on the same router and
process them accordingly.


> You can use the Variable $4 from Event. The Variable $4 has three parts:
> IP Adress  Timestamp ObjectID

Cheers,
       Kent