|
Re: [nv-l] [EC] State C0rrelation Engine duplicate rule doesn't suppress duplicates
2005-03-10 19:29:39
Jane, does this mean that you are modifying
the message field on an event on its way to TEC? That is my dream.
Cordially,
Leslie A. Clark
IBM Global Services - Systems Mgmt & Networking
(248) 552-4968 Voicemail, Fax, Pager
Jane Curry <jane.curry AT skills-1st.co DOT uk>
Sent by: owner-nv-l AT lists.us.ibm DOT com
03/10/2005 04:11 PM
|
|
To
| NetView mailing list <nv-l AT lists.us.ibm DOT com>,
tme10 <tme10 AT lists.us.ibm DOT com>
|
|
cc
|
|
|
Subject
| [nv-l] [EC] State C0rrelation
Engine duplicate rule doesn't suppress duplicates |
|
I have TEC 2.9 FP2 and NetView 7.1.4 FP2 on a SuSE
9.1 Professional system.
I have added 1 extra state correlation engine ( SCE ) rule to the
provided nvsbrule.xml rules file that comes with NetView:
<rule id="netview.dupAuthRemove">
<eventType>TEC_ITS_BASE</eventType>
<duplicate timeInterval="60000">
<cloneable attributeSet="hostname"/>
<predicate>
<![CDATA[
&nv_generic == "4"
]]>
</predicate>
</duplicate>
<triggerActions>
<action function="TECSummary"
singleInstance="false">
<parameters>
SET:msg="Authentication
Trap Summary"
</parameters>
</action>
</triggerActions>
</rule>
I am generating 8 traps that match this and I am seeing an event with
the message "Authentication Trap Summary" so the rule is obviously
firing but I am ALSO seeing all the individual events too. They all
come from the same hostname inside 60 seconds. The summary event
has a
repeat count of 0.
I have tracing and logging turned on for the state correlation but can't
see anything helpful in there.
Anyone else seen this or can see what I have done wrong? I just have
a
vague idea I had heard of a bug with the duplicate SCE rule - mebbe on
Linux???
Cheers,
Jane
--
Tivoli Certified Consultant & Instructor
Skills 1st Limited, 2 Cedar Chase, Taplow, Bucks, SL6 0EU, UK
Tel: +44 (0)1628 782565
Copyright (c) 2005 Jane Curry <jane.curry AT skills-1st.co DOT uk>. All
rights reserved.
|
|
|
