Working on a new environment setup of TEC/Netview. 
Like a lot of what's in the products as far as rules and such. 

Planning to implement the following  event policy:

- Clearing Events from NetView remain open XX minutes. After that time,
they are automatically closed. 

My intent is not to alter the underlying correlations in netview.rls at
all. 
If a correlation closed or changes something already, let it do so. 
In fact the way the rules work now, they do a very good job at this. 
But the events that ultimately resolve an ERN (event relationship
network) remain open.
I would like to close them automatically after a reasonable amount of
time (xx minutes). 

My thoughts are to add set_timer predicates to each event that passes
through any
of the *_lower rules:

interface_lower
isdn_lower
snmp_lower
node_lower
router_lower 
subnet_lower
interface_added_lower
interface_managed_lower
node_added_lower
node_managed_lower
sa_status_lower
l2_status_lower

Then I can add a timer_rule into the set: if event is still open, then
close. 
Anything already closed by existing rules isn't impacted.
Those 'lingering' open, harmless events are closed. 

Thought I give anyone else which some experience with the ruleset a
chance to chime in with
their thoughts. 

My gut after studing the ruleset is that:
  - no current rules or behaviors are impacted
  - any re-analysis shouldn't be impacted either

Input is appreciated. 



Jon Austin
Tivoli/Unix Administrator
Information Systems
Children's Hospital of Philadelphia