Re: [ovforum] Correlation in NNM 6.x or third party applic

     As far as I know the tecad do not read from trapd.log, but uses the
     API's. Do you know if tecad for NNM 6.0 is able to distinguish between
     the different event streams (raw, correlated and all)? If it is you'll
     probably be able to get the events you want and do the final filtering
     in tecad.

     - Michael.


______________________________ Reply Separator _________________________________
Subject: [ovforum] Correlation in NNM 6.x or third party applicatio
Author:  Non-HP-nieto-a ("nieto_a"@tsm.es) at HP-Belgium,mimegw3
Date:    27-10-99 17:49




10/27/99 05:49 PM
(subscript: Agustin Nieto Moro@TSM)
We have the following environment:
NNM 6.0 with a TEC adapter to send events to the Tivoli Event Console. We do
manually the correlation rules in TEC, but we are interested in doing a local
correlation firstly in the NNM station, and send to the TEC only the correlated
events. Options:

1) NNM 6.x: TEC adapter reading the trapd.log. When a router goes down we don't
receive in the event browser the events of the workstations behind this subnet
(those events appear correlated in the window under the + signal), but in the
trapd.log we see all events plus an openview event like this:

"941036882 1 Wed Oct 27 17:08:02 1999 pilar      - Indicate correlation for
4e6f20c2-8c80-71d3-0451-3702010a0000.;1 17.1.0.58916879 0"

This event appears after a node down. I don't know the meaning of the event. I
would like to have the events in the trapd.log like:

1.-  RouterA  Node down
2.-  workstation1 Node down, correlated by 1
3.-  workstation2 Node down, correlated by 1
4.-  workstation3 Node down, correlated by 1
5.- Some event saying "RouterA is the cause root for the events 2) 3) and 4)"

In summary, I want to read "workstation Node Down" in the trapd.log only in case
 that there are no other events of "router down" relacionated.
Is it posible to decode the information in the "indicate correlation
event...58916879" event?

If this option is not posible go to option 2.

2) 3rd party applications like TFNC, Smarts InCharge, integrated with NNM with
the following features:
- Integration with NNM: reading directly from the topology database and
determine automatically the root cause.
- Integration with TEC: Sending the correlated events directly to the TEC
(Tivoli For Network Connectivity) or writing these correlated events in a log
file to be read by a TEC adapter. (Smarts?)
- "out of the box solution" with minimal maintenance.

Which of these applications is better?
Any comparative?
Any other application to take into account?

Thanks in advance.

------------------------------------------
Agustin Nieto
Telefonica Moviles S.A.
Spain.



This list server service is provided by OpenView Forum International,
the independent organization of OpenView users, developers,
and systems integrators.

Support us by becoming a member.
Apply today at http://www.ovforum.org/lev1/membership.htm
Mail list subscribe/unsubscribe information can be found at http://www.ovforum.o
rg/tech/reflectordes.cfm