Morning James,
I
actually am trying to suppress these first at NV to give TEC a break. The event
stream is set to block--I am trying to do this in TEC_ITS.rs. My explanation
below apparently was confusing; I have a Trap Settings node (I called it an
object) with only the clogMessageGenerated trap defined. It is the only trap
within this Enterprise ID. I placed the Thresholds node between this Trap
Setting and the Forward node. When it did not work there I tried putting the
Threshold node between the Event Stream and Trap Settings node for grins. Based
on what you are saying, I had it right the first time, but it does not work for
some reason.
Drew
The first order of
business is to stop trying to do this at TEC and start doing it in the Event
Display. Only when you have it working
there should you implement it as part of your TEC ruleset. The Event
Display and the TEC forwarding work exactly alike, so once you can see it, you
know it will work.
Second,
All rulesets start with the event stream node, the thing that looks like
a purple pizza. Open your ruleset in the ruleset editor, nvrsEdit, and
click on the Event Stream. Does it say BLOCK or PASS. It must say
BLOCK if your ruleset is going to filter events out.
Third, what ruleset nodes precede your Threshold?
Trap Settings? Event Attributes? What? How do you know
you are thresholding on the right traps?
James Shanks Level 3
Support for Tivoli NetView for UNIX and Windows Tivoli Software / IBM
Software Group
| "Van Order, Drew \(US - Hermitage\)"
<dvanorder AT deloitte DOT com> Sent by: owner-nv-l AT lists.us.ibm DOT com
01/20/2004 07:50 PM Please respond to nv-l
| To:
<nv-l AT lists.us.ibm DOT com> cc:
Subject: [nv-l] [nv 7.1.4]
Suppressing duplicate clogMessageGenerated traps prior to reaching
TEC
|
Hi
all,
I have searched the list archives and read the
Admin guide--and must be doing something wrong. I am trying to implement a
Thresholds rule to pass the first trap, then suppress the rest for 30 minutes.
I want to suppress duplicates based on the enterprise ID and Origin (IP
address). There is only one trap associated with this enterprise ID.
I take this as the settings should be:
Type is First Count is 1 Time Period
is 30 Attribute 1 is Origin
Cycle daemons--not working. Have also tried setting
EnterpriseID as Attr 1 (even though it's default) and Origin as Attr 2. Have
also tried setting the count to 2. I have put this object in between the Trap
Settings and Forward objects, and have also put in between Event Stream and
Trap Settings. I see numerous events at TEC. What am I doing wrong?
Thanks for helping a rook with a rook question!
Drew Van Order ESM
Architect (615) 882-7836 Office (888)
530-1012 Pager
This message (including any
attachments) contains confidential information intended for a specific
individual and purpose, and is protected by law. If you are not the intended
recipient, you should delete this message. Any disclosure, copying, or
distribution of this message, or the taking of any action based on it, is
strictly prohibited.
This message (including any attachments) contains confidential information intended for a specific individual and purpose, and is protected by law. If you are not the intended recipient, you should delete this message. Any disclosure, copying, or distribution of this message, or the taking of any action based on it, is strictly prohibited.
|