Well, your ruleset is very inefficient. The first thing you apparently do
for ALL traps, of whatever origin, is check the ovwdb database to see if
the sending host is in collection "Routers" and then in collection
"Switches". Most likely they are not. But nvcorrd, which processes the
ruleset, must wait while the ovwdb processing to check collection
membership completes, twice for each trap. That means that this is done
for even "Log Only" traps and everything else. I'll bet that nvcorrd gets
bogged down when a bunch of traps comes in, or when ovwdb is being heavily
used by another process (such as netmon).
What you should do, in my opinion, is check some traps settings before you
call the collection check and only process traps you know will be
significant for those routers or switches, like link down, node down, and
so on. By pre-selecting the types of significant traps, which nvcorrd has
immediate access to, you cut down his processing tremendously.
By the way, you can see what nvcorrd is doing by issuing the command
nvcdebug -d all
and then browsing the nvcorrd.alog and .blog. You turn the trace off
again by issuing
or stopping and restarting nvcorrd.
Tivoli (NetView for UNIX) L3 Support
Igor Podlivalchev <firstname.lastname@example.org> on 04/06/99 09:30:47
Please respond to email@example.com
cc: (bcc: James Shanks)
Subject: Ruleset problem: Delay in forwarding events to Event window
I'd like to feed our on-duty staff with only critical network information.
I've created a ruleset, which forwards out network events from critical
nodes (routers, switches, RMON agents), other events are discarded.
nodes are part of corresponding collection.
Structure of the ruleset are quit simple:
Event ----- (is contained in collection "Router") -------------> forward
+-------------(is contained in collection "Switches") -----> (is RMON
trap) -------> forward
+-------------------> (is not RMON trap) -----> (severity >3) --->forward
But, after activation of this ruleset, I saw considerable delay in
processing events. Sometimes event time shift (delay between when event
really arise in the network and displayed in either Event window) may reach
Does anybody can give me any idea on how fight this problem out?