"Leslie Clark" <lclark AT us.ibm DOT com> writes:

> Well, I know it is harder to start with the TEC, but that is what it
> is really good at, that sort of correlation. I understand that in
> Netview V7.1 they have included a ruleset for TEC that does
> a fair amount of correlation not only of the Router Fault Isolator
> events, but also of the node/interface events. If it is not there,
> it is not hard for a TEC rulewriter to do. You will, of course,
> have a TEC rulewriter on hand, won't you (that's a hint that
> you will need one....).  If you are going to do TEC, don't
> waste your time doing this correlation on Netview. Just
> send all interface and node events for the intesting devices
> to the TEC and handle it  there.
> 
> Anybody else?

The experience-based caveat to your suggestion would be "provided that
doing so won't cause TEC performance problems due to TEC cache
growth."

In our environment, we try to push the correlation back as close to
the devices as possible in the event flow.  We use some simple node
interface correlation rulesets provided in the NetView example
rulesets with a few tweaks.  

Noficiation based on hostname is something done at the TEC level or
beyond for us.  For a smaller environment, I imagine an event flow
that sends all events through a notification script that looks up
hosts and does appropriate actions would be rather do-able.  

-- 
Todd H.
http://www.toddh.net/