Hello all,
I have a need to report the length of time a node is down.
I have been trying to use ruleset processing to work with the IBM_NDWN_EV
and IBM_NUP_EV events. I receive the events, and can match the events for
a given device. So far, so good. The difficulty I am having is in trying
to access the attribute information from both traps (once they have been
matched) so I can pass them to a script for further processing. I was able
to do it by setting the correlation value from the node_down and then the
node_up, but it seemed kludgy. And since there's only one set of rolling
correlation fields, I'd rather not waste it on this.
I've tried the documentation (manuals, online, man pages), but it didn't go
into much depth. In fact, that and some testing led to further questions:
1) Since the "pass on match" node can access event attributes from two
matched traps, is there any way I can access it too during ruleset
processing? I'd like to obtain the $NVT and $NVATTR_4 from each of the
matched traps.
2) Can someone please clarify which agent's sysUpTime is reported in the
sysUpTime Event Attribute Value? (Ref. Admin Guide p. 5-35) From my
testing and viewing the debug output in nvcorrd logs, it does not appear to
be the uptime of the device being reported on in the trap (the device at
$NVA).
3) When doing a demand poll of a node that is down, the output contains
"down since ....." and a date/time stamp. Where is this information
stored, and is it accessible?
I'm curious if others are measuring this and how. Open to any suggestions,
documentation references, etc.
Thanks in advance,
Karin
|