A ruleset is a program executed by a daemon, specifically, nvcorrd. In
that sense it is like a script. But since it works off incoming traps, you
can cause it to be executed so frequently that your system cannot provide
enough cpu for nvcorrd to keep up. It is that simple. When this occurs,
you will see in the nvcorrd.alog that he is caching incoming traps.
Eventually, he will process them all, but it may take a very long time.
So it is up to you, as the ruleset programmer, to try to write an efficient
rule. This may mean that the "simple" rule you have in mind is too simple
-- it doesn't cut down the number of incoming traps enough so that nvcorrd
can keep up. Or it may mean that in some situations, you have to drop the
ruleset altogether, or else live with the poor performance. Even events
display, fed by plain old forwardall.rs, cannot keep up if the incoming
traps arrive faster than about 5 per second.
I will append in another note a document which I recently wrote for the
Level 2 folks to give out to customers who need some hints on ruleset
performance.
James Shanks
Tivoli (NetView for UNIX) L3 Support
"Jorge A. Jiles" <Jorge.Jiles@UALBERTA.CA> on 07/30/98 05:14:28 PM
Please respond to Discussion of IBM NetView and POLYCENTER Manager on
NetView et alia <NV-L@UCSBVM.UCSB.EDU>
To: NV-L@UCSBVM.UCSB.EDU
cc: (bcc: James Shanks)
Subject: Rulesets
Hello there; I'm running nv5.0 under aix 4.2.1 on an rs6000 240 dual
processor.
here goes the problem:
There is a simple ruleset that checks all netmon and agents traps; verifies
that the device is being managed and pass arguments to an action script. It
works ok for single or few traps at once but when we have problems with one
of our main campus routers (the netview server goes through this router)
sometimes we get traps to be process by the ruleset up to two hours later
(I must mention that due to the lack on dependency tree capabilities of
netview we get hundreds of traps at once). The trap is logged immediately
into the trapd.log but when it has to be process by the ruleset sometimes
takes an awful long time. Does any of the daemons such as nvcorrd or
actionsrv caches entries if netview gets to many traps at once? Part of the
action script is to write the outage to an outage log; the entries on this
log are something like every 2 minutes untill all traps (hundreds) have
been logged. So if the main router coldstarts per say at midnight the first
entry is right at midnight and the last is at something like 02:00.
No "process table full" message was log on the server either.
Any ideas would be appreciated.
thanks.
.
Jorge A. Jiles
Network Analyst
Computing & Network Services
University of Alberta
Edmonton, Alberta
Canada
|