Re: [nv-l] MLM events in TEC - state correlation
2004-08-05 17:01:34
I would not know what to tell you.
We do not recommend any user modifications
to the xml rules file for state correlation.
That's why there is no documentation
on how to use them for your own purposes. If you change them or add
to them, then you are quite literally on your own. And there are
no plans for the xml rule files to replace nvcorrd rulesets.
I am sorry to tell you this, but the
ruleset editor remains the one and only supported method of deciding what
goes to TEC in NetView for UNIX, whether you are happy with it or not.
And the current direction is not to
do so much correlation in NetView anyway, but rather to do it in TEC. NetView
is now a part of TEC and the TEC guys have provided an entirely new set
of rules there to correlate events for you. If you are trying to
correlate events like Interface_Up/Interface_Down/Node_Up/Node_Marginal/Node_Down/Router_Down/Router_Marginal/Router_Up,
that's exactly what the new TEC rules do right out of the box. Those
that match will close the others, and those that remain open increase in
severity over time.
Besides, how did we go from problems
with a 6.0.3 migration, with MLM event parsing failures, to writing
your own stuff for the State Correlation engine?
This is a completely new topic, isn't
it?
James Shanks
Level 3 Support for Tivoli NetView for UNIX and Windows
Tivoli Software / IBM Software Group
wolfgang.bergbauer AT attglobal DOT net
Sent by: owner-nv-l AT lists.us.ibm DOT com
08/05/2004 03:48 PM
|
To
| nv-l AT lists.us.ibm DOT com
|
cc
|
|
Subject
| Re: [nv-l] MLM events in
TEC - state correlation |
|
Hi James,
I had a parsing error in state correlation engine, I think it was a problem
with the formatting of the trap when using snmptrap. Trapd processed the
event without issues, but the state correlation engine did not, so it never
made it to TEC.
Now one question in regards to the State Correlation. I spend almost the
whole day getting a simple reset on match rule to work, without success.
Does anybody know if the function defined within the default rules, just
stop further rule processing for TEC_ITS_NODE_STATUS events.
The idea I had was to use the state correlation for delaying Node Status
and Router status events for 5 minutes. In the past we used the Ruleset
editor, which I really hate because we have quite a big ruleset and it
is a nightmare to maintain this rule. (You have to docment seperately what
is under the icons).
Thanks for your information and kind regards,
Wolfgang
------------------------------------------------------------------
Wolfgang Bergbauer
Network and System Management Consultant
Cell phone: +49 172 534 9131
E-mail: wolfgang.bergbauer AT attglobal DOT net
James Shanks <jshanks AT us.ibm DOT com>
Sent by: owner-nv-l AT lists.us.ibm DOT com
04.08.2004 20:39
Please respond to
nv-l AT lists.us.ibm DOT com |
|
To
| nv-l AT lists.us.ibm DOT com
|
cc
|
|
Subject
| Re: [nv-l] MLM events in
TEC |
|
All events sent by nvserverd go as TEC_ITS_BASE unless you define another
default event class in tecint.conf or specifically define an event class
in trapd.conf. TEC_ITSBASE replaces the old Nvseverd_Event class
as the default class. By the way, the only way you would see events
you don't expect over in TEC is if you were using some ruleset other than
TEC_ITS.rs or if you modified it.
trapd.conf entries ignored? You'd have to prove that to me. Having
worked on this code for 7 years, I'm willing to bet that's not true.
So what are you expecting that you don't see?
James Shanks
Level 3 Support for Tivoli NetView for UNIX and Windows
Tivoli Software / IBM Software Group
wolfgang.bergbauer AT attglobal DOT net
Sent by: owner-nv-l AT lists.us.ibm DOT com
08/04/2004 02:09 PM
|
To
| nv-l AT lists.us.ibm DOT com
|
cc
|
|
Subject
| [nv-l] MLM events in TEC |
|
Hi all,
After migrating Netview 6.0.3 to Netview 7.1.4 FP01 we see problems with
our MLM events.
All the MLM events are coming into TEC as TEC_ITS_BASE, with some variables
that identify it as MLM/Threshold events, with a generic and specific trapd
ID
Now 2 issues here:
1. When I look into trapd.conf, there is no TEC Event defined for MLM/Threshold
events. How can it go to TEC then as TEC_ITS_BASE.
2. For all our MLM ARM/ReARM events I have specific entries in the
trapd.conf with OID of Tivoli/MLM_Threshold {1.3.6.1.4.1.2.6.12.5.1} and
a unique specific trap ID.
This definition seems to be completely ignored.
Thanks for your help.
Kind regards,
Wolfgang
------------------------------------------------------------------
Wolfgang Bergbauer
Network and System Management Consultant
Cell phone: +49 172 534 9131
E-mail: wolfgang.bergbauer AT attglobal DOT net
|
|
|