It is good to worry about doing that
from the TEC ruleset. What I have done in the past is an inline action,
which also makes me nervous, that does a grep for the attribute in a flat
file. Then you just administer the file. You will have to mess around with
it to get the logic and return code evaluation right.
Cordially,
Leslie A. Clark
IT Services Specialist, Network Mgmt
Information Technology Services Americas
IBM Global Services
(248) 552-4968 Voicemail, Fax, Pager
"Van Order, Drew \(US
- Hermitage\)" <dvanorder AT deloitte DOT com>
Sent by: nv-l-bounces AT lists.ca.ibm DOT com
11/21/2006 12:40 PM
Please respond to
Tivoli NetView Discussions <nv-l AT lists.ca.ibm DOT com> |
|
To
| "Tivoli NetView Discussions"
<nv-l AT lists.ca.ibm DOT com>
|
cc
|
|
Subject
| [NV-L] Best method to filter traps from
specific IP addresses in ruleset |
|
Hi everyone,
Our customer has been receiving Peribit
traps for a few weeks. It currently looks like this in the ruleset:
Trap Settings node for Peribit trap Enterprise
ID (all traps highlighted) ----> Forward to TEC
Customer has requested that for just one
of the traps, we only forward if it comes from 4 IP addresses, otherwise
drop. I figure I will deselect this trap from the current Trap Settings
node, then add a second Peribit Trap Settings node with just the one trap
highlighted. It's after this step that I am wondering what will be most
efficient.
I know I can create a SmartSet with just
these 4 IP addresses, but understand SmartSet queries in rulesets are very
expensive, and I don't want to compromise performance since this is also
our TEC_ITS ruleset. Is there a better way to do this w/o Smart Set query?
I don't want to create a TEC rule for this, I think it's smarter to do
it closest to the trap source.
Thanks!---Drew
Drew Van Order
Information Technology Services
Deloitte Services LP
Tel: +1 615 882 7836
www.deloitte.com
This message (including any attachments)
contains confidential information intended for a specific individual and
purpose, and is protected by law. If you are not the intended recipient,
you should delete this message.
Any disclosure, copying, or distribution
of this message, or the taking of any action based on it, is strictly prohibited.
[v.E.1]_______________________________________________
NV-L mailing list
NV-L AT lists.ca.ibm DOT com
Unsubscribe:NV-L-leave AT lists.ca.ibm DOT com
http://lists.ca.ibm.com/mailman/listinfo/nv-l (Browser access limited to
internal IBM'ers only)
_______________________________________________
NV-L mailing list
NV-L AT lists.ca.ibm DOT com
Unsubscribe:NV-L-leave AT lists.ca.ibm DOT com
http://lists.ca.ibm.com/mailman/listinfo/nv-l (Browser access limited to
internal IBM'ers only)
|