Terje Lindholm wrote:
>
> No I dont meen snmp oid's, i refer to netview DB objects.
>
> In variable 4, the string contains to my knowledge:
>         ip-address
>         time-stamp
>         node DB object-id
>         interface DB object-id

Using the API, you could write a simple c program to return the
selection name of an object id.  You could pass $4 to an inline action
script that parses out the pid from that, runs the c program to get the
selection name, compare that to a list of interface names you care about
and if it is, exit with the return code which the ruleset will use to
pass it to the next (forward) node.

Shell script would look like this:
#!/bin/ksh
IFOID=$4
IFTYPE=$(listfld -o $IFOID -f "SNMP ifType")     # listfld is a C
program (attached)
# the egrep command looks for strings matching either Ethernet or Frame
Relay or Serial.
if [[ -n $(print ${IFTYPE} | egrep "Ethernet|Frame Relay|Serial") ]]
then
    exit 0
else
    exit 1
fi


The script is called fom an inline action, and returns 0 if the
interface name contains
either Ethernet or Frame Relay or Serial. If the script returns 0, the
inline action node would be set to send the event to the next node in
the ruleset.

This is fairly cheap, but if you get lots of interface down events (say
10 a second for a period of a few minutes), you may want to rethink this
as it could impact performance.

Perhaps you should consider doing as Leslie suggested and send another
trap of your own design where one of the variables is the object ID of
the Interface. Then you can place a throttling mechanism inside to
prevent numerous simultaneous database queries.

Hope this helps.

--
Ray Schafer                   | schafer AT tkg DOT com
The Kernel Group              | Network Computing Consulting

listfld.c
Description: application/unknown-content-type-c_auto_file