nv-l

[nv-l] netview - detecting event storms?

2003-07-01 08:57:46
Subject: [nv-l] netview - detecting event storms?
From: dmahler AT telcordia DOT com
To: nv-l AT lists.tivoli DOT com
Date: Tue, 1 Jul 2003 08:55:51 -0400



Well, we had another incident recently where a core switch had a problem and the VLAN where netview was living got affected.   Netview ended up thinking that the world was ending and sent out hundreds of alerts to TEC - this flooded the TEC and made many people unhappy.

I have tried many things through the years to address these sorts fo things, including re-pings and retests, alert rate thresholds, page suppression by reporter ("stop all the paging for netview")....etc...  Have had some success, but...  I have not come up with a solid way to make netview behave
in a common sense way: " when it looks like you cannot get anywhere, don't assume the entire network has gone down".   I was wondering if other had faced the same issues and had any other ideas.  

My setup is that I have a series of mid-level managers (MLM's - netview , spectrum, others) feeding tivoli TEC(s).   I would prefer to handle this in the MLM's, rather than write a lot of TEC rules (dependency clauses and fact files), since this means that TEC has to get very busy in processing the flood....    ideas?  Other techniques?


thanks for any suggestions,


Don Mahler
SAIC


ps On a related question, is there yet a rule writer for netview (windows), similar to what used to exist for netview/aix?
<Prev in Thread] Current Thread [Next in Thread>