I've setup netview to do pretty much what you're requiring, I just did it a
completely different way.
First, Use the SNMP Collection system. Create an entry that collects data
from the mib value that you're trying to query, and set the interval for 30
minutes. Set it to just check thresholds, not store the data. Set the
threshold value for 90%, and set a rearm value. But don't use the default
Trap #. Go into Trap editor and make a copy of the Threshold trap
(IBM_NVDCOL_EV), only give it a totally different trap number. Like 1101 or
something. Then create a copy of the threshold rearm trap and give it a
trap number right above the one you assigned to the threshold event (i.e.
1102). Then specify this trap number in the snmp collection you've created
for the cpu utilization.
Then create a ruleset that looks for the 1101 trap, and if you've recieved
that trap then you know that utilization has been over 90% for 30 minutes.
So setup your notification in this ruleset. Add this ruleset to
ESE.automation.
Trap 1102 will be the rearm trap that will occur when the rearm value is
reached. So you can build that into the ruleset if you want.
tada! It works pretty good for me.
-----Original Message-----
From: Jeff Singer [mailto:jsinger@RICOCHET.NET]
Sent: Thursday, December 17, 1998 12:20 PM
Subject: Ruleset Help
Currently I am collecting certain mib variables off routers and
servers. I am collecting the information every 5 minutes. Additionally
I have set thresholds for some of these values as well. What I would
like to do is create a ruleset that will send me an email when a
mibvalue is at a certain level for a specified period of time. So, for
example if CPU utilization is over 90% for 30 minutes. I have not been
able to successfully create this ruleset and am now turning to you for
help.
Here is what I've tried so far, but this isn't working. This ruleset is
supposed send an email when a router's CPU is over 90% for 30 minutes:
event stream -> trap settings (set for netview6000 enterprise,
IBM_NVDCOL_EV event) ->
event attribute (attribute: 4 equal to value: .1.3.6.1.4.1.9.2.1.58) ->
thresholds (after, count: 5, Time Period:30) -> action (echo "$2: $3" |
mailx -s "Threshold Exceeded" mailme@myemail.com) -> forward
A few questions and comments:
- In the event attribute node, attribute 4 in IBM_NVDCOL_EV is the mib
variable being collected.
- The reason I sent count to 5 is, since I am collecting on 5 minute
intervals, if the threshold is met every collection interval and an
event is sent from IBM_NVDCOL_EV, then after 5 would be approximately 30
minutes.
- While testing the action node, I got it to send me an email, but the
$2 and $3 were not passed (all I got was a : with nothing on either
side). I know this command works because it is virtually the same
command I use in the event configuration to send me messages when a
IBM_NVNDWN_EV happens. With IBM_NV_DCOL_EV, $2 is the node name or IP
address and $3 is the event description. Why didn't these get sent
properly ?
- In the thresholds node, what is the "Threshold by attribute 1...n "
supposed to do. I though I would be able to make a comparison with this
value but there is no place to input a value to compare against. So if
I set attribute 1 to, say, source, what is this doing ? The
documentation doesn't provide much help. All the documentation says is
that it "Specifies the first attribute in the trap to be used." Used
how ?
Is this what I should be doing to get my intended results ? One thing I
realized is, that in order to get a IBM_NV_DCOL_EV event to be sent every
time the threshold is exceededd, I need to set the re-arm event higher than
the threshold event. Otherwise, if the threshold doesn't go below the rearm
event for the 5 polling periods, only one event will be sent.
Sorry if this is long winded and I pointed out obvious things, but the
way the ruleset nodes work are not too intuitive.
Thanks
Jeff
*************************************************************
* Jeffrey H. Singer Phone: 408-399-8257 *
* Network Engineer Email: jeff.singer@metricom.com *
* Metricom, Inc. Web: http://www.metricom.com *
*************************************************************
|