nv-l

Re: Ruleset problem

2001-07-01 08:45:11
Subject: Re: Ruleset problem
From: moshe_asseo AT il.ibm DOT com
To: nv-l AT lists.tivoli DOT com
Date: Sun, 1 Jul 2001 15:45:11 +0300
Hello,
I have the following rulset -
                    Event Stream ->Event Attributes -> Query Database Field
-> Override -> Forward -> Action
In the override section I am changing the severity of the event from minor
to major.
When moving this rulset to background ( update in ESE.automation ),  I
omitted the forward, but now the severity doesn't change in the Event
display.
Can anybody tell me what should I do ?
James,
perheps you have an idea since you were very precise on this clarification.

Best regards,
Moshe' Asseo.
Technical support group
IBM Global Services Israel
-------------------------------------------
Tel. 972-3-5316820 , Ext. 6820   ,    Mobile: 972-50-369245   ,
Fax.972-3-5313580
E-Mail: moshe_asseo AT il.ibm DOT com


"James Shanks" <SHANKS AT us.tivoli DOT com> on 06/28/2001 04:58:16 PM

Please respond to IBM NetView Discussion <nv-l AT tkg DOT com>

To:   IBM NetView Discussion <nv-l AT tkg DOT com>
cc:
Subject:  Re: [NV-L] Ruleset problem




"Resolve" does not work in the background.  It is a command only to the
event display and actionserver does not have one of those, so it does
nothing.

James Shanks
Team Leader, Level 3 Support
Tivoli NetView for UNIX and NT


moshe_asseo AT il.ibm DOT [email protected] on 06/28/2001 09:03:42 AM

Please respond to IBM NetView Discussion <nv-l AT tkg DOT com>

Sent by:  owner-nv-l AT tkg DOT com


To:   IBM NetView Discussion <nv-l AT tkg DOT com>
cc:
Subject:  Re: [NV-L] Ruleset problem





James,
Your item 1 below is very helpfull.
I understand that before handover any ruleset to ESE.automation you should
remove any "forward", "resolve" and change "pass" to "block", am I right ?
Could you say what whould you use instead of "resolve", what will happen
when working in background ?

Best regards,
Moshe' Asseo.
Technical support group
IBM Global Services Israel
-------------------------------------------
Tel. 972-3-5316820 , Ext. 6820   ,    Mobile: 972-50-369245   ,
Fax.972-3-5313580
E-Mail: moshe_asseo AT il.ibm DOT com


"James Shanks" <SHANKS AT us.tivoli DOT com> on 28/06/2001 13:23:41

Please respond to IBM NetView Discussion <nv-l AT tkg DOT com>

To:   IBM NetView Discussion <nv-l AT tkg DOT com>
cc:
Subject:  Re: [NV-L] Ruleset problem




Rulesets in ESE.automation are loaded by the actionsvr daemon.  When you
change what is in ESE.automation then you must re-start actionsvr to get
him to re-read that file and register those rulesets with nvcorrd.
actionsvr has his own logs, /usr/OV/log/nvaction.alog/blog.  In there you
can watch him do the load and you can watch him attempt to execute any
Action node from your ruleset (as opposed to inline actions which are done
by nvcorrd).

Answers to minor questions.
1.  actionsvr is a daemon with no display.  What he knows how to do is
execute actions, command, using the events passed to him as arguments.  If
you use a Forward in a ruleset run by actionsvr, then he gets the event
data but no action and does not know what to do with this data sitting on
his input queue, so it lays there.  Eventually the queue fills up,
actionsvr stops processing, and then nvcorrd's output queue to him fills
up, and he stops processing, and you have hung the entire mechanism.  For
this reason, rulesets run in the background should not contain a Forward, a
Resolve (which is just a special case of Forward), or have their initial
node set to PASS rather than BLOCK.

2.  The ruleset editor creates a temporary copy of your ruleset every time
you edit it, so that you can blow away your changes at the last minute.  He
takes the current file, say "aaa.rs" and makes a backup copy, "aaa.rs.BAK",
and one called "aaa.<random_character_string>" as the temp copy.  This copy
is removed if the editor is exited normally .  If the editor is killed and
the copy remains, you can just delete it.

James Shanks
Team Leader, Level 3 Support
Tivoli NetView for UNIX and NT


"Chan, Jack" <jack.chan AT nz.unisys DOT com>@tkg.com on 06/28/2001 12:57:00 AM

Please respond to IBM NetView Discussion <nv-l AT tkg DOT com>

Sent by:  owner-nv-l AT tkg DOT com


To:   "'IBM NetView Discussion'" <nv-l AT tkg DOT com>
cc:
Subject:  [NV-L] Ruleset problem



I was playing around with rulesets, and I have a question:

I removed ruleset A in ESE.automation, and put ruleset B in ESE.automation.

And I did a ovstop and ovstart.

My /log/nvcorrd.alog file, shows:

001/28/06 16:49:36     ./nl_nvcorrd.C[944] :    ><************ nvcorrd
starting
 *************
2001/28/06 16:49:36     ./nl_nvcorrd.C[945] :    ><nvcorrd level:11/13
2001/28/06 16:49:36   CorrelationDef.C[186] :   Open error for ruleset
load:/usr
/OV/conf/rulesets/A.rs

It seems like it was trying to load up ruleset A, which I don't want!!
How can I fix this??


Some minor questions:
1. In the administrator guide it says, Do not put a forward node in the
ruleset started in ESE.automation, why?
2. Sometimes under /usr/OV/conf/ruleset, I have A.rs, and some funny files
like A.rs12Y123 A.rs80r35, etc. why?

thanks a lot, Jack.
_________________________________________________________________________
NV-L List information and Archives: http://www.tkg.com/nv-l


_________________________________________________________________________
NV-L List information and Archives: http://www.tkg.com/nv-l



_________________________________________________________________________
NV-L List information and Archives: http://www.tkg.com/nv-l


_________________________________________________________________________
NV-L List information and Archives: http://www.tkg.com/nv-l


<Prev in Thread] Current Thread [Next in Thread>