Hi all,
There is a known issue with the iflist slot not being able to
accommodate a large number of IP addresses when a major router has an
issue. The event fails TEC parsing, so any rules processing dependent on
that event being open or in the cache are moot. TS's fix for now is to
go into the trap settings and remove the slot from the TEC mapping since
the iflist slot is not used for any rule decision making. Anyone run
across this yet?
Thanks--Drew
-----Original Message-----
From: owner-nv-l AT lists.us.ibm DOT com [mailto:owner-nv-l AT lists.us.ibm DOT
com]
On Behalf Of Brandon Mitchell
Sent: Saturday, April 24, 2004 7:39 AM
To: nv-l AT lists.us.ibm DOT com
Subject: Re: [nv-l] SNMPTraps to TEC
The third way would be in the cds file. Just make 4 entries for the
same trap. Then, include the the trap's varbind severity in the SELECT
section and put the associated TEC severity in the MAP section. If you
only have a few of these, it's not a big deal, but I'd look at your
other options if you have lots of traps like this.
If you are interested in doing it via a TEC rule, just ask. It
shouldn't take to long to write up something like that.
On Fri, 2004-04-23 at 16:53, ray.smith AT clorox DOT com wrote:
> One way to do it is on the NV side. The other way is to do it on the
> TEC side.
>
> NV requires sending himself a second trap and doing a case statement
> to map 1, 2, 3, 4, 5 to whatever severity you want. TEC requires
> slotting one of those numbers and then adjusting the severity over
> there in a rule.
>
> I just learned how to do this myself for the firs time.
>
> I chose to do something like this on the NV side of in a parsing
> script that generated the second trap.
>
> case $4 in
> "P1" ) TECSeverity=FATAL;;
> "P2" ) TECSeverity=CRITICAL;;
> "P3" ) TECSeverity=WARNING;;
> "P4" ) TECSeverity=HARMLESS;;
> esac
>
> TECSeverity is the new argument in the trap and is mapped to
> $Vsomenumber
>
> and then you assign $Vsomenumber to the severity slot on TEC
>
>
>
> Ray Smith
> IS Engineer
> The Clorox Services Company
> 925-425-4363
>
>
>
> "Jeff Chwirut"
> <jchwirut AT riggsbank DOT com>
> Sent by:
> owner-nv-l AT lists.us.ibm DOT com
>
> 04/23/2004 12:45 PM
> Please respond to nv-l
>
> To:
> <nv-l AT lists.us.ibm DOT com>
> cc:
> Fax to:
> Subject:
> [nv-l] SNMPTraps to TEC
>
>
>
>
> I have what is probably a stupid question here, and take it easy on me
> here since I am newbie. I have an application that is forwarding traps
> to netview which I want to forward events to TEC. The problem that I
> have is the application's severity (which is passed via varbind4) is
> #1 a number [1-5] and #2 their severity doesn't not match a TEC
> Severity. How does one take these severities and re-map them to proper
> TEC Severities? I want to map 5 to CRITICAL, 4 to MINOR, 3 & 2s to
> WARNING and 1 to HARMLESS. Any insight would be great.
>
> Thanks,
>
> Jeff Chwirut
> System Engineer
> Riggs Bank NA
>
>
>
************************************************************************
**************************
> Our transmission is intended only for the proper addressee. The
> transmission may
> contain confidential, privileged or copyrighted material. If you
> received this
> transmission in error, we apologize for the inconvenience. Please
> contact the sender,
> and delete material from your computers. Any review, further
> transmission,
> dissemination or other use of, or taking action in reliance on this
> information by anyone
> other than the intended recipient is not authorized.
>
>
>
************************************************************************
**************************
>
************************************************************************
**************************
--
Brandon Mitchell <bmitch3020 AT cox DOT net>
http://members.cox.net/bmitch3020/
This message (including any attachments) contains confidential information
intended for a specific individual and purpose, and is protected by law. If
you are not the intended recipient, you should delete this message. Any
disclosure, copying, or distribution of this message, or the taking of any
action based on it, is strictly prohibited.
|
