Here's what I have done for the external
traps:
For each MIB with traps, add to TEC_ITS.rs
an Event Attribute cube specifying the Enterprise, with a Forward.
In the trapd.conf for the traps in that
Enterprise, set the ones you do NOT want to forward to Log Only. Nvserverd
will not see those marked Log Only.
This makes for a simple and fast filter
on the traps.
In the odd case where you need to filter
one of those traps by device, add an additional Trap Settings for the specific
trap, and do an inline action that greps a flat file.
This externalizes some controls, eg
the log only business and the flat file business so there is less complexity
in the ruleset and less disruption of the flow of events when you want
to make changes.
Cordially,
Leslie A. Clark
IT Services Specialist, Network Mgmt
Information Technology Services Americas
IBM Global Services
(248) 552-4968 Voicemail, Fax, Pager
"Van Order, Drew \(US
- Hermitage\)" <dvanorder AT deloitte DOT com>
Sent by: nv-l-bounces AT lists.ca.ibm DOT com
11/27/2006 11:44 AM
Please respond to
Tivoli NetView Discussions <nv-l AT lists.ca.ibm DOT com> |
|
To
| "Tivoli NetView Discussions"
<nv-l AT lists.ca.ibm DOT com>
|
cc
|
|
Subject
| [nv-l] Splitting up TEC integration
by using TEC_ITS and another ruleset
for external traps in ESE.automation 7.1.4/7.1.5 |
|
Anyone doing this successfully? I ask because
TEC_ITS.rs is now unwieldy with both internal and external trap processing.
We are also getting requests to perform additional filtering/processing
on external traps prior to forwarding to TEC. It spooks me to think of
doing this all in TEC_ITS. I thought a solution could be having a ruleset
in ESE.automation that handles all external traps/processing. The forwarding
to TEC would be handled by an Action node that fires a script invoking
postemsg, or running postemsg directly and passing trap variables.
Alas, it appears that none of the TEC slot
mappings are passed as variables to an action node. Nor are they passed
to the environment if you run an automatic action in trapd.conf. I searched
the list archives before posting this, good chance someone has already
asked this same question. Too bad nvserverd can't work with more than one
ruleset; that would be the ideal situation.
Thanks--
Drew Van Order
Information Technology Services
Deloitte Services LP
Tel: +1 615 882 7836
www.deloitte.com
This message (including any attachments)
contains confidential information intended for a specific individual and
purpose, and is protected by law. If you are not the intended recipient,
you should delete this message.
Any disclosure, copying, or distribution
of this message, or the taking of any action based on it, is strictly prohibited.
[v.E.1]_______________________________________________
NV-L mailing list
NV-L AT lists.ca.ibm DOT com
Unsubscribe:NV-L-leave AT lists.ca.ibm DOT com
http://lists.ca.ibm.com/mailman/listinfo/nv-l (Browser access limited to
internal IBM'ers only)
_______________________________________________
NV-L mailing list
NV-L AT lists.ca.ibm DOT com
Unsubscribe:NV-L-leave AT lists.ca.ibm DOT com
http://lists.ca.ibm.com/mailman/listinfo/nv-l (Browser access limited to
internal IBM'ers only)
|