I
started on it last night, and it does have some very useful information.
Unfortunately the NV side is where I am struggling the most; namely the trap
configurations and NV forwarding ruleset. Until that is understood and confirmed
configured correctly to match what TEC expects it's tough to tell how well the
TEC rule is working. I just opened a sev 3 PMR; also offered to help write any
documentation that could be considered a guide. Like most IT folks, I don't have
the luxury of focusing on one project at a time, and really need to slam and jam
when solutions are deemed shrink wrap.
Thanks
for looking into this!
Drew,
I don't know if
you have looked at it yet but you might want to check out the TEC 3.9 Rule Set
Reference
http://publib.boulder.ibm.com/tividd/td/tec/SC32-1282-00/en_US/PDF/ecosmst.pdf
It goes into detail about what all the
rulesets do (including netview.rls)
thanks, Chris Haynes haynesch AT us.ibm DOT com Tivoli Quality
Assurance Manager (919) 224-1217
| "Van Order, Drew \(US - Hermitage\)"
<dvanorder AT deloitte DOT com> Sent by: owner-nv-l AT lists.us.ibm DOT com
01/14/2004 08:09 PM Please respond to nv-l
| To:
<nv-l AT lists.us.ibm DOT com> cc:
Subject: [nv-l] Has anyone
implemented the full TEC integration (correlation rules) NV 7.1.4 and
TEC 3.9 |
If
there is a single document, can someone point me to it? I've found pieces and
parts in the different manuals, but it's not working out of box (as advertised
by our sales team):
- Netview.baroc and netview.rls in rulebase
- Netview6000 traps in NV ruleset TEC adapter
uses
- Netview6000 traps have TEC_ITS event classes
mapped in xnmtrap
Events reach TEC, but severities do not make sense,
and I'm sure this means any change rules in the ruleset will not execute. For
example, TEC_ITS_INTERFACE_STATUS is HARMLESS at TEC, yet message is interface
xxx is down. However, I have a SEGMENT_STATUS and NETWORK_STATUS event as
WARNING in TEC, but the message indicates they are up. The netview6000 traps
are set from previous versions where TEC classes were OV_. I directly edited
TEC classes for each trap in xnmtrap, but I think this issue pertains to TEC
slots that are not being passed in the trap or matching what the TEC rule
expects.
We are trying to replace TFNC, which has been worth
every penny. Do I need to feed the netview6000 MIB through mib2trap again--and
will this populate xnmtrap properly? What's the name of the mibfile that
contains the netview6000 OID?
Sorry for all the questions--since this integration
crosses NV and TEC boundaries, I'm not sure if a PMR will get me anywhere. I
think I'm getting close, but there has to be an easier way.
Thanks--Drew
Drew Van Order
ESM Architect (615) 882-7836
Office (888) 530-1012 Pager
This message (including any attachments) contains confidential
information intended for a specific individual and purpose, and is protected
by law. If you are not the intended recipient, you should delete this message.
Any disclosure, copying, or distribution of this message, or the taking of any
action based on it, is strictly prohibited.
This message (including any attachments) contains confidential information intended for a specific individual and purpose, and is protected by law. If you are not the intended recipient, you should delete this message. Any disclosure, copying, or distribution of this message, or the taking of any action based on it, is strictly prohibited.
|