> BTW
> i testet following rules, and surprisingly they seem to do the same job:
>    Event Stream (block) -> Trap Setting (Not equal to Specific 58916864) ->
>    query database collection (origin in "server") -> Forward event
>    Event Stream (pass) -> Trap Setting (equal to Specific 58916864) ->
>    query database collection (origin not in "server") -> Block event
> any ideas why both rules are working and filter the same traps (the
> event-display is identical)?

Seems pretty straight forward to me:
   If the event stream is "block" all events that are forwarded are
displayed.
      You are forwarding traps from node name "server" except if the
specific is
      58916864.  Therefore the only events seen are those from "server"
but not
      specific 58916864.

   If the event stream is "pass", all events that are not blocked are
displayed.
      You are blocking all traps equal to specific 58916864 and from any
node
      except "server". Therefore the only events seen are those from
"server" but
      not specific 58916864.


BTW,  I would think that the second choice would be more efficient,
because:
   1.  nvcorrd would have to do collection queries for every trap whose
specific is not 58916864 in the first example (block), whereas in the
second example, only traps that have a specific value of 58916864 are
used for the collection query.

   2. The collection query is an external (to nvcorrd) process, but the
specific value of the trap is known by nvcorrd as a trap attribute - no
external call is required.


--
Ray Schafer                   | schafer AT tkg DOT com
The Kernel Group              | Network Computing Consulting