nv-l

[nv-l] Hostname field is empty in TEC event.

2004-02-10 11:21:43
Subject: [nv-l] Hostname field is empty in TEC event.
From: bill.kellam AT worldspan DOT com
To: "nv-l " <nv-l AT lists.us.ibm DOT com>
Date: Tue, 10 Feb 2004 11:14:14 -0500



Hello,

My installation is nv7.1.4, AIX 5.2.

I'm forwarding an event to TEC and the hostname slot shows up empty.
Shouldn't it correspond to the trap hostname? Here is my test results using
snmptrap.  I get the resolved IP address in the origin slot, but the
hostname is empty.

command:
/usr/OV/bin/snmptrap phapnnv1.wspan.net .1.3.6.1.4.1.5956
core-5500-h1.wspan.net 6 102 0 \
             .1.3.6.1.4 octetstring "MY MONITOR" \
             .1.3.6.1.4 octetstring "Bills Test Trap Page" \
             .1.3.6.1.4 octetstring " Are You Alive : FAIL " \
             .1.3.6.1.4 octetstring "CRITICAL"

trapd.log:
1076352217 3  Mon Feb 09 13:43:37 2004 core-5500-h1.wspan.net    A WWW_MON
Alert

wtdumprl:
1~47915~1~1076423660(Feb 10 09:34:20 2004)
### EVENT ###
WWW_MON;
source=nvserverd;
nv_generic=6;
category=1;
nv_var4="CRITICAL";
nv_var3=" Are You Alive :  FAIL ";
msg="WWW_MON Alert ";
nv_var2=" Bills Test Trap Page ";
date="02/10/04 09:34:18";
nv_var1=" MY MONITOR ";
nv_specific=102;
nv_enterprise=Worldspan;
status=OPEN;
adapter_host=phapnnv1.wspan.net;
hostname=;
origin=10.5.1.253;
sub_source=A;
END

### END EVENT ###
PROCESSED


trapd.conf:
convertedWWWMON {1.3.6.1.4.1.5956} 6 102 A 4 0 "Status Events"
WWW_MON Alert
EVENT_CLASS WWW_MON
SDESC
This event is WWW-MON event.
EDESC


Forward and reverse lookup correct:
Name:    core-5500-h1.wspan.net
Address:  10.5.1.253

tecint.conf:
ServerLocation=tivtec1.worldspan.com
TecRuleName=tecfwd.rs
ServerPort=5529
DefaultEventClass=TEC_ITS_BASE
BufferEvents=YES
UseStateCorrelation=YES
StateCorrelationConfigURL=file:///usr/OV/conf/nvsbcrule.xml
## The following four lines are for debugging the state correlation engine
# LogLevel=ALL
# TraceLevel=ALL
# LogFileName=/usr/OV/log/adptlog.out
# TraceFileName=/usr/OV/log/adpttrc.out

Best regards,
Bill Kellam
Enterprise Integration and Management



<Prev in Thread] Current Thread [Next in Thread>