Are you sure that all the Events in trapd.log are displayable? Try to
find one which is not in Event History and then check its Event
Configuration. Does it say "Log Only"? Then that is why you don't see it.
But all incoming events are passed to the ovevent log and the "Log Only"s
can fill it up.
Other than that I don't know what else could be the issue. Except that
Event History was never designed to be able to show events back as far as
you want (last week). Best I have ever seen is one or two days. The
whole idea (I believe, since this code is virtually untouched from HP days)
was to give a second shift operator the capability to see if there were
events earlier in the day which might apply to a problem he was working
now, or perhaps let him query as far back as yesterday, to see if a node
had had recent problems. But that was about all. In my view, the design
assumptions go back to when this was a departmental rather than an
enterprise tool, and that may make it unsuitable for what you want. Sorry.
Most folks I know that want data older than yesterday, use the trapd.logs,
though there is not GUI for that.
James Shanks
Tivoli (NetView for UNIX) L3 Support
"Lemire, Mark" <mlemire@JHANCOCK.COM> on 06/16/99 04:29:04 PM
Please respond to Discussion of IBM NetView and POLYCENTER Manager on
NetView <NV-L@UCSBVM.UCSB.EDU>
To: NV-L@UCSBVM.UCSB.EDU
cc: (bcc: James Shanks/Tivoli Systems)
Subject: V.5.1.1/Solaris: Event History
We recently upgraded from V.5.0, but could never get the Event History to
work correctly under the older release.
With V.5.1.1, we have changed the default event log size to 2048kb which
appears to be the maximum size allowed (we changed this under Tivoli to
make
it permanent). We are also not using any filters in order to get all
historical events in ovevent.log.
Trapd.log was started on June 7th (9 days ago), is currently just under 3.5
meg and has over 26,000 events. The current size of ovevent.log is nearly
1.3 meg, yet would appear to contain far fewer observable events than
trapd.log. We can't seem to get more than a handfull (under 200) events to
display in the Event History display before ovevent.log rolls over to the
backup. This takes place every few hours. Our operators would like to use
Event History to review events from as far back as the previous week. The
way it stands, we can't access the morning's events by early afternoon!
I wanted to get feedback from the forum before opening a PMR. Has anyone
had better success using Event History? Does anyone have any suggestion as
to what we may be doing wrong?
Thanks!
Mark
|