[nv-l] Ruleset efficiency using Trap Settings versus Event Attributes
We are testing Compaq traps and there are a considerable number of them
under Compaq's Enterprise ID. Suppose you have 200 traps under one
enterprise ID, but only 15 that need forwarding to TEC. Is it more
1. Use a Trap Settings node set at the enterprise ID
2. Use a Trap Settings node with only the 15 traps highlighted under the
3. Use an Event Attributes node set for equal to enterprise ID
4. Use an Event Attributes node for each specific trap (like TEC_ITS)
I think we have a lot of inefficiency in our NV ruleset and like TEC, a
tight ruleset means best event processing.
This message (including any attachments) contains confidential information
intended for a specific individual and purpose, and is protected by law. If
you are not the intended recipient, you should delete this message. Any
disclosure, copying, or distribution of this message, or the taking of any
action based on it, is strictly prohibited.