Re: [nv-l] Has anyone implemented the full TEC integration (correlation rules) NV 7.1.4 and TEC 3.9
2004-01-16 15:53:32
In NV 7.1.4 state correlation does 2
things:
Appends fqhostname slot on events
Generates Service impacts events.
If you are not forwarding these events
to a TEC 3.9 server then they will fail to parse because fqhostname slot
is not defined in pre-3.9 netview.baroc file.
The recommended workaround of turning
off state correlation should enable you to see 7.1.4 events on pre-3.9
TEC server.
Also note, I believe servmon is turned
off by default. If you turn on servmon the events he generates will
also not show up in pre-3.9 servers as they are not defined in the netview.baroc
file.
thanks,
Chris Haynes
haynesch AT us.ibm DOT com
Tivoli Quality Assurance Manager
(919) 224-1217
| Jane Curry <jane.curry AT skills-1st.co DOT uk>
Sent by: owner-nv-l AT lists.us.ibm DOT com
01/16/2004 03:04 PM
Please respond to nv-l
|
To:
nv-l AT lists.us.ibm DOT com
cc:
Subject:
Re: [nv-l] Has anyone implemented the
full TEC integration (correlation rules) NV 7.1.4 and TEC 3.9 |
I think that the only stuff that disabling state correlation
affects is
if you are wanting to correlate service events from NetView with subnet
events from NetView. Certainly I have some node/router/interface
up/down correlation going on. I shall be doing more work on this
week
so I'll keep you posted?
Cheers,
Jane
Van Order, Drew (US - Hermitage) wrote:
>Jane wins the prize--disabling state correlation now has events
>appearing in TEC...and the up's are HARMLESS, the downs/unreachable
>WARNING. Unfortunately, I'm not seeing the up or reachable again events
>closing the corresponding downs and unreachables. Does the state
>correlation option somehow enable the change rules in netview.rls?
>
>-----Original Message-----
>From: owner-nv-l AT lists.us.ibm DOT com [mailto:owner-nv-l AT lists.us.ibm DOT com]
>On Behalf Of Jane Curry
>Sent: Friday, January 16, 2004 2:42 AM
>To: nv-l AT lists.us.ibm DOT com
>Subject: Re: [nv-l] Has anyone implemented the full TEC integration
>(correlation rules) NV 7.1.4 and TEC 3.9
>
>
>Unless you have TEC 3.9 running then comment out the lines:
>UseStateCorrelation=YES
>StateCorrelationConfigURL=file:///usr/OV/conf/nvsbcrule.xml
>
>and run nvtecia -reload to pick up the modified config. Even
if you do
>have TEC 3.9, you might start by commenting these lines out to see
if it
>
>is the State Correlation that is getting in the way.
>
>Cheers,
>Jane
>
>Van Order, Drew (US - Hermitage) wrote:
>
>
>
>>I really screwed up guys--was looking at the 7.1 guide. The 7.1.4
UNIX
>>
>>
>
>
>
>>Guide has some decent information that gets you going in the right
>>direction. I ran the upgrade script and cycled the daemons.
>>Unfortunately, I see no events at TEC, nothing in wtdumprl, and
>>nothing in the /etc/Tivoli/tec cache files. I know TEC_ITS.rs exists
>>because I looked at it yesterday. Old tecint.conf:
>>
>>ServerLocation=dsmrdux02
>>TecRuleName=Trap2Tec.rs
>>ServerPort=0
>>
>>New tecint.conf:
>>
>>ServerLocation=dsmrdux02
>>TecRuleName=TEC_ITS.rs
>>ServerPort=0
>>DefaultEventClass=TEC_ITS_BASE
>>BufferEvents=YES
>>UseStateCorrelation=YES
>>StateCorrelationConfigURL=file:///usr/OV/conf/nvsbcrule.xml
>>## The following four lines are for debugging the state correlation
>>
>>
>engine
>
>
>># LogLevel=ALL
>># TraceLevel=ALL
>># LogFileName=/usr/OV/log/adptlog.out
>># TraceFileName=/usr/OV/log/adpttrc.out
>>
>>
>>TFNC events are coming through. Any suggestions? Thank you for
your
>>patience--Drew
>>
>> -----Original Message-----
>> *From:* owner-nv-l AT lists.us.ibm DOT com
>> [mailto:owner-nv-l AT lists.us.ibm DOT com] *On Behalf Of
*James Shanks
>> *Sent:* Thursday, January 15, 2004 2:39 PM
>> *To:* nv-l AT lists.us.ibm DOT com
>> *Subject:* RE: [nv-l] Has anyone implemented the
full TEC
>> integration (correlation rules) NV 7.1.4 and TEC
3.9
>>
>>
>> Drew -
>>
>> The phrase "nvserverd.baroc" does not appear
anywhere in the 7.1.4
>> Admin Guide and the section Chris pointed to has
revision bars on
>> every page indicating that is new and changed material.
Are you
>> certain that you are reading the 7.1.4 version?
>>
>> James Shanks
>> Level 3 Support for Tivoli NetView for UNIX
and Windows
>> Tivoli Software / IBM Software Group
>>
>>
>>
>>
*"Van Order, Drew \(US - Hermitage\)" <dvanorder AT deloitte DOT com>*
>> Sent by: owner-nv-l AT lists.us.ibm DOT com
>>
>> 01/15/2004 02:59 PM
>> Please respond to nv-l
>>
>>
>> To:
<nv-l AT lists.us.ibm DOT com>
>> cc:
>> Subject:
RE: [nv-l] Has anyone implemented the full
>> TEC integration (correlation rules) NV 7.1.4 and
TEC 3.9
>>
>>
>>
>>
>> Thank you. I read this yesterday, but it's older
information,
>> referencing nvserverd.baroc, when it's now netview.baroc.
I guess
>> that's my point; there are fragments of information
in different
>> documents. I only found the new files because I was
pointed to the
>> release notes! You have to piece it together as best
you can and
>> hope what you are reading is correct. I'm very grateful
for you
>> folks on the list. If this new correlation works,
it is material
>> for a chapter in a redbook or the next set of NV
manauls.
>> -----Original Message-----*
>> From:* owner-nv-l AT lists.us.ibm DOT com
>> [mailto:owner-nv-l AT lists.us.ibm DOT com] *On Behalf Of
*Christopher
>> Haynes*
>> Sent:* Thursday, January 15, 2004 11:51 AM*
>> To:* nv-l AT lists.us.ibm DOT com*
>> Subject:* RE: [nv-l] Has anyone implemented the full
TEC
>> integration (correlation rules) NV 7.1.4 and TEC
3.9
>>
>>
>> Drew,
>> Check out the stuff starting
at the bottom of page 110 of
>> teh NetView Administrator's Guide.
>>
>>
>>
>>
>http://publib.boulder.ibm.com/tividd/td/netview/SC32-1246-00/en_US/PDF/d
>uyl2mst.pdf
>
>
>>
>>
>> thanks,
>> Chris Haynes
>> haynesch AT us.ibm DOT com
>> Tivoli Quality Assurance Manager
>> (919) 224-1217
>>
>>
>>
>>
*"Van Order, Drew \(US - Hermitage\)" <dvanorder AT deloitte DOT com>*
>> Sent by: owner-nv-l AT lists.us.ibm DOT com
>>
>> 01/15/2004 12:32 PM
>> Please respond to nv-l
>>
>>
>> To: <nv-l AT lists.us.ibm DOT com>
>> cc:
>> Subject:
RE: [nv-l] Has anyone implemented the full
>> TEC integration (correlation rules) NV 7.1.4 and
TEC 3.9
>>
>>
>>
>>
>>
>> No doubt I overlooked something between the KB and
manuals--where
>> can I find this script? I did a find for TEC_* and
tec_* no file
>> resembling that name. If you can also point me to
where this is
>> documented, I would be grateful. Thanks James--Drew
>> -----Original Message-----*
>> From:* owner-nv-l AT lists.us.ibm DOT com
>> [mailto:owner-nv-l AT lists.us.ibm DOT com] *On Behalf Of
*James Shanks*
>> Sent:* Thursday, January 15, 2004 11:01 AM*
>> To:* nv-l AT lists.us.ibm DOT com*
>> Subject:* RE: [nv-l] Has anyone implemented the full
TEC
>> integration (correlation rules) NV 7.1.4 and TEC
3.9
>>
>>
>> Drew -
>>
>> I'm stumped about what is confusing to you.
>> There is no configuration for you to do, other than
run the
>> tec_its_upgrade script and create a new tecint.conf
(which happens
>> nicely if you rename your old one and create a new
one from
>> serversetup).
>>
>> The script changes the configuration of the NetView
events in
>> trapd.conf so that they work with the new TEC rules.
It makes
>> TEC_ITS_BASE the new default event class instead
of the old
>> Nvserverd_Event class. And it removes
severity as passed field,
>> because severity will be set dynamically by the new
TEC rules, and
>> they cannot do that correctly if you are sending
your choice of
>> severity instead. The NetView ruleset is the
same one we shipped
>> in NetView 7.1.3 : TEC_ITS.rs. Bring
it up in the NetView
>> ruleset editor and you'll see that it just picks
out specific
>> NetView events and sends them to TEC. If you
want additional
>> events, from Cisco or something, you'll have to add
those, but
>> those lie outside of the new integration.
>>
>> That's all there is to the NetView side.
>>
>> James Shanks
>> Level 3 Support for Tivoli NetView for UNIX
and Windows
>> Tivoli Software / IBM Software Group
>>
>>
*"Van Order, Drew \(US - Hermitage\)" <dvanorder AT deloitte DOT com>*
>> Sent by: owner-nv-l AT lists.us.ibm DOT com
>>
>> 01/15/2004 11:24 AM
>> Please respond to nv-l
>>
>>
>> To: <nv-l AT lists.us.ibm DOT com>
>> cc:
>> Subject:
RE: [nv-l] Has anyone implemented the full
>> TEC integration (correlation rules) NV 7.1.4 and
TEC 3.9
>>
>>
>>
>>
>>
>>
>> I started on it last night, and it does have some
very useful
>> information. Unfortunately the NV side is where I
am struggling
>> the most; namely the trap configurations and NV forwarding
>> ruleset. Until that is understood and confirmed configured
>> correctly to match what TEC expects it's tough to
tell how well
>> the TEC rule is working. I just opened a sev 3 PMR;
also offered
>> to help write any documentation that could be considered
a guide.
>> Like most IT folks, I don't have the luxury of focusing
on one
>> project at a time, and really need to slam and jam
when solutions
>> are deemed shrink wrap.
>>
>> Thanks for looking into this!
>> -----Original Message-----*
>> From:* owner-nv-l AT lists.us.ibm DOT com
>> [mailto:owner-nv-l AT lists.us.ibm DOT com] *On Behalf Of
*Christopher
>> Haynes*
>> Sent:* Thursday, January 15, 2004 9:57 AM*
>> To:* nv-l AT lists.us.ibm DOT com*
>> Subject:* Re: [nv-l] Has anyone implemented the full
TEC
>> integration (correlation rules) NV 7.1.4 and TEC
3.9
>>
>>
>> Drew,
>> I don't know if you have looked at
it yet but you might want
>> to check out the TEC 3.9 Rule Set Reference
>>
>>
>>
>>
>http://publib.boulder.ibm.com/tividd/td/tec/SC32-1282-00/en_US/PDF/ecosm
>st.pdf
>
>
>> It goes into detail about what all the rulesets do
(including
>> netview.rls)
>>
>> thanks,
>> Chris Haynes
>> haynesch AT us.ibm DOT com
>> Tivoli Quality Assurance Manager
>> (919) 224-1217
>>
>>
*"Van Order, Drew \(US - Hermitage\)" <dvanorder AT deloitte DOT com>*
>> Sent by: owner-nv-l AT lists.us.ibm DOT com
>>
>> 01/14/2004 08:09 PM
>> Please respond to nv-l
>>
>>
>> To: <nv-l AT lists.us.ibm DOT com>
>> cc:
>> Subject: [nv-l]
Has anyone implemented the full TEC
>> integration (correlation rules) NV 7.1.4 and TEC
3.9
>>
>>
>>
>>
>>
>>
>>
>> If there is a single document, can someone point
me to it? I've
>> found pieces and parts in the different manuals,
but it's not
>> working out of box (as advertised by our sales team):
>>
>> * Netview.baroc and netview.rls in
rulebase
>> * Netview6000 traps in NV ruleset TEC
adapter uses
>> * Netview6000 traps have TEC_ITS event
classes mapped in
>>
>>
>xnmtrap
>
>
>> Events reach TEC, but severities
do not make sense, and I'm
>> sure this means any change rules
in the ruleset will not
>> execute. For example, TEC_ITS_INTERFACE_STATUS
is HARMLESS
>> at TEC, yet message is interface
xxx is down. However, I
>> have a SEGMENT_STATUS and NETWORK_STATUS
event as WARNING in
>> TEC, but the message indicates
they are up. The netview6000
>> traps are set from previous
versions where TEC classes were
>> OV_. I directly edited TEC classes
for each trap in xnmtrap,
>> but I think this issue pertains
to TEC slots that are not
>> being passed in the trap or
matching what the TEC rule
>>
>>
>expects.
>
>
>> We are trying to replace TFNC,
which has been worth every
>> penny. Do I need to feed the
netview6000 MIB through
>> mib2trap again--and will this
populate xnmtrap properly?
>> What's the name of the mibfile
that contains the netview6000
>> OID?
>>
>> Sorry for all the questions--since
this integration crosses
>> NV and TEC boundaries, I'm not
sure if a PMR will get me
>> anywhere. I think I'm getting
close, but there has to be an
>> easier way.
>>
>> Thanks--Drew
>>
>> */Drew Van Order/* */
>> ESM Architect/* */
>> (615) 882-7836 Office/* */
>> (888) 530-1012 Pager/*
>>
>> This message (including any
attachments) contains
>> confidential information intended
for a specific individual
>> and purpose, and is protected
by law. If you are not the
>> intended recipient, you should
delete this message. Any
>> disclosure, copying, or distribution
of this message, or the
>> taking of any action based on
it, is strictly prohibited.
>>
>> This message (including any
attachments) contains
>> confidential information intended
for a specific individual
>> and purpose, and is protected
by law. If you are not the
>> intended recipient, you should
delete this message. Any
>> disclosure, copying, or distribution
of this message, or the
>> taking of any action based on
it, is strictly prohibited.
>>
>> This message (including any
attachments) contains
>> confidential information intended
for a specific individual
>> and purpose, and is protected
by law. If you are not the
>> intended recipient, you should
delete this message. Any
>> disclosure, copying, or distribution
of this message, or the
>> taking of any action based on
it, is strictly prohibited.
>>
>> This message (including any
attachments) contains
>> confidential information intended
for a specific individual
>> and purpose, and is protected
by law. If you are not the
>> intended recipient, you should
delete this message. Any
>> disclosure, copying, or distribution
of this message, or the
>> taking of any action based on
it, is strictly prohibited.
>>
>>
>>This message (including any attachments) contains confidential
>>information intended for a specific individual and purpose, and
is
>>protected by law. If you are not the intended recipient, you should
>>delete this message. Any disclosure, copying, or distribution of
this
>>message, or the taking of any action based on it, is strictly
>>
>>
>prohibited.
>
>
>
>
>
--
Tivoli Certified Consultant & Instructor
Skills 1st Limited, 2 Cedar Chase, Taplow, Bucks, SL6 0EU, UK
Tel: +44 (0)1628 782565
Copyright (c) 2004 Jane Curry <jane.curry AT skills-1st.co DOT uk>. All
rights reserved.
|
<Prev in Thread] |
Current Thread |
[Next in Thread>
|
- RE: [nv-l] Has anyone implemented the full TEC integration (correlation rules) NV 7.1.4 and TEC 3.9, (continued)
- RE: [nv-l] Has anyone implemented the full TEC integration (correlation rules) NV 7.1.4 and TEC 3.9, James Shanks
- RE: [nv-l] Has anyone implemented the full TEC integration (correlation rules) NV 7.1.4 and TEC 3.9, Van Order, Drew (US - Hermitage)
- RE: [nv-l] Has anyone implemented the full TEC integration (correlation rules) NV 7.1.4 and TEC 3.9, James Shanks
- RE: [nv-l] Has anyone implemented the full TEC integration (correlation rules) NV 7.1.4 and TEC 3.9, Van Order, Drew (US - Hermitage)
- RE: [nv-l] Has anyone implemented the full TEC integration (correlation rules) NV 7.1.4 and TEC 3.9, Van Order, Drew (US - Hermitage)
- RE: [nv-l] Has anyone implemented the full TEC integration (correlation rules) NV 7.1.4 and TEC 3.9, Van Order, Drew (US - Hermitage)
- RE: [nv-l] Has anyone implemented the full TEC integration (correlation rules) NV 7.1.4 and TEC 3.9, Van Order, Drew (US - Hermitage)
- RE: [nv-l] Has anyone implemented the full TEC integration (correlation rules) NV 7.1.4 and TEC 3.9, Van Order, Drew (US - Hermitage)
|
|
|