Hi Donald,
thanks for your help.
To ease up the handling
of traps, we added a "inline action" (+ grep command) and a forward node as you
suggested,
but I´m curious to know if there could
be a more flexible way to handle (check) traps belonging to a
defined set of
enterprise
ID´s?
I was thinking of a
inline action node inside a ruleset that runs a grep to text file consting
of different enterprise ID´s, but the
problem seems to
be the syntax,
the enterprise ID (i.e. variable $NVE) is based on. There is no defined amount
of digits that
such a
enterprise ID
does consist of - right?
To run a grep against a
text file covering all acceptable enterprise traps would be a solution that
could be easily maintained as
far as I understand it.
Thanks.
best regards,
Thorsten Mildeberger
EMS Solutions - SMC Tools &
Automation ITO - Central
Region EDS Deutschland GmbH
Eisenstr. 43 65428 Rüsselsheim Tel.: +49 (0) 6142 80-3706 Fax.: +49 (0) 6142
80-3030
mailto:thorsten.mildeberger AT eds DOT com
I may be reading more into your question than you meant.
I am going to assume that you would like any "Private
Enterprise" trap to trigger some action. Instead of
using the Event Attribute, use the InLine Action to grep for any OID that starts
with 1.3.6.1.4.1.
[STREAM]-->[InLineAction]-->[Action]
Configure the [InLineAction] like this: Command: echo $NVE | grep -E "^1\.3\.6\.1\.4\.1\." Wait Interval: 1 Exit Code: 0
Don Davis
-----Original Message----- From:
Mildeberger, Thorsten [mailto:thorsten.mildeberger AT eds DOT com]
Sent: Wednesday, January 12, 2005 9:28 AM
To: nv-l AT lists.us.ibm DOT com Subject:
[nv-l] Event Attributes
hi all, this is more or less a simple
question, but I just would like to understand if I got it right.
lets assume traps with the following two enterprise id´s get
sent to netview acting as a trap receiver.
the ruleset consists of a "Event Attributes" icon and a "Forward
icon" and is set to "Block". the Event Attributes" icon is configured with the
"Equal To" operator and set to "1.3.6.1.4.1".
am I right in thinking that traps belonging to enterprise id
"1.3.6.1.4.1.674.4413.1.2.3" and "1.3.6.1.4.1.412.2.4.55" for instance would get
blocked as the operator was set to "Equal To"?
to let those traps through, TWO "Event Attributes" icons would
be needed here, one with enterprise id "1.3.6.1.4.1.674.4413.1.2.3" and one with
"1.3.6.1.4.1.412.2.4.55", both having the "Equal To" operator set?
no other chance to get it done in another easier way?
thanks.
best regards, > Thorsten
Mildeberger > > EMS
Solutions - SMC Tools & Automation > ITO -
Central Region > EDS Deutschland GmbH
> Eisenstr. 43 > 65428
Rüsselsheim > Tel.: +49 (0) 6142 80-3706
> Fax.: +49 (0) 6142
80-3030
> mailto:thorsten.mildeberger AT eds DOT com
>
------------------------------------------------------------------------------ This
electronic mail and any files transmitted with it are confidential and are
intended solely for the use of individual or entity to whom they are addressed.
If you are not the intended recipient or the person responsible for delivering
the electronic mail to the intended recipient, be advised that you have received
this electronic mail in error and that any use, dissemination, forwarding,
printing, or copying of this electronic mail is strictly prohibited. If you have
received this electronic mail in error, please immediately notify the sender by
return
mail. ==============================================================================
|