In the reset on match node (which I use to cancel the page if the interface
comes up within 30 seconds - on the interface down page I also launch a ping of
the interface for 30 seconds, one ping every 2 seconds) I compare attributes 2
(the node name) and 4.1 (the ip address of the interface in question) to see if
they are equal.  Same thing in the pass on match node which correlates
interface up pages to only those that exceeded the 30 seconds down limit.
 This makes sure the up/down traps are related for the interface, not just the
node.

Leslie Clark wrote:

> Steve and Patrick, can  you expand on how you match up these events to make
> sure they refer to the same interface? The message has to be parsed,
> doesn't it?
> Or are you assuming that the next Interface Up trap about that router will
> be for the
> same interface?
>
> Cordially,
>
> Leslie A. Clark
> IBM Global Services - Systems Mgmt & Networking
> Detroit
>
> ---------------------- Forwarded by Leslie Clark/Southfield/IBM on
> 01/07/2000 11:28 AM ---------------------------
>
> Steve Francis <steve.francis AT COMMSERV.UCSB DOT EDU>@UCSBVM.UCSB.EDU> on
> 01/07/2000 10:38:28 AM
>
> Please respond to Discussion of IBM NetView and POLYCENTER Manager on
>       NetView <NV-L AT UCSBVM.UCSB DOT EDU>
>
> Sent by:  Discussion of IBM NetView and POLYCENTER Manager on NetView
>       <NV-L AT UCSBVM.UCSB DOT EDU>
>
> To:   NV-L AT UCSBVM.UCSB DOT EDU
> cc:
> Subject:  Re: stupid question
>
> Matt Ashfield wrote:
>
> > Hi all,
> >
> > I have been trying to get a ruleset to work lately, and have been having
> > problems with it. I basically want it to work like this.
> >
> > If something goes down and does not come back up within 2 minutes,
> perfrom
> > an action.
> >
> > I have this working for certain nodes, like the ip's of switches and what
> > not, but I want to get it to work for my router interfaces. So if I have
> > like 10 interfaces on a router, and only one of htem goes down, then
> it'll
> > recognize that an Interface went down.
> >
> > THe problem here is, I'm not sure which trap to look for.
>
> Interface down trap is indeed the one to use.  I suspect that your problem
> lies in the mechanism you are using to decide if the router is one of the
> "certain nodes" that you care about. (i.e. if you are testing the IP
> address
> of the router interface that went down against the IP address of the node
> name
> that netview knows the router by, its not usually going to match.)
> Probably the easiest way to do this is to create a colection of MajorNodes,
> put all your routers, switches, etc, in it, and then use the ruleset object
> that tests whether the trap is from an object in that collection.