|
I think you want
to use a RESET ON MATCH for this purpose. A PASS ON MATCH will, as you are
seeing, pass to the action node those node-up/downs that DO match. The
RESET, though, will halt when a match is made, so only those that do NOT match
will be passed to the action
node.
Hi all,
I am just starting to play with creating
rulesets. I've had some trouble getting one of them going. I am trying to
get the ruleset to send an email if a NVNDWN_EV (netview node down event) is
received and a NVNDUP_EV (netview node up event) for that downed node is NOT
received within a time threshold. So basically I want to get an email if a
node has been down for a particular period of time without being back up...I
did this by creating two trap events. One is a NVNDWN_EV trap and the other
is a NVNDUP_EV trap. I use these as inputs to a PASS ON MATCH. I try and
match the nodename, Event Attribute 2...I then use this PASS ON MATCH as
input to an ACTION which is my script which sends the email.
The way I have it now, it emails me
everytime a node goes down, the rulest is defind as follows if it
helps:
RuleSet6 RuleSet TrapID7
TrapID10
"" 1
TrapID7 TrapID AttrJoin8
netView6000
1.3.6.1.4.1.2.6.3 6 58916865 0
"netView6000
1.3.6.1.4.1.2.6.
3"
"IBM_NVNDWN_EV
Specific 58916865 " ""
0
AttrJoin8 AttrJoin Action9
"" 0 "" 120 0 0
"2 2 0~"
Action9 Action
"/home/mda/mattdown
$NVATTR_2" ""
TrapID10 TrapID AttrJoin8.2
netView6000
1.3.6.1.4.1.2.6.3 "6 " "58916864 " 1
"netView6000
1.3.6.1.4.
1.2.6.3"
"IBM_NVNUP_EV
Specific 58916864 " ""
0
Any help would be
geatly appreciated....
Matt Ashfield
|