Does anyone have any experience using rulesets for NT?
I have some that I am building on a RS/6000 with the ruleset editor, and
am having some difficulty getting them to work on NT.
The first one is a simple resolve ruleset that resolves an agent link
down trap with a link up trap. The ruleset basically has the event
stream set to block.
The stream goes to two nodes: both trap attributes: the top for link
down, the bottom for link up.
The link down trap goes to two nodes: forward and "pass on match" (as
input 1).
The link up goes to the same "pass on match" as input 2.
The pass on match looks at Origin, and attribute 1 for the match within
1 minute.
The pass on match sends it to a reslove node.
That's it. I run it from an nvevents screen as a ruleset in UNIX and it
works as expected:
I only see the link down trap and when the link up trap comes in within
a minute, the link down trap is resolved.
On NT, I tried using it as a filter in the event browser, and I get
nothing. Not a thing in the event browser even though I see plenty of
the traps I want to correlate. If I try to register the ruleset with
nvcorrd, it causes it to crash when I get a link down event.
I can find no documentation on what nodes in a ruleset are supposed to
work on NT and which aren't. It looks as though the filter is only
looking for traps with an origin of the ruleset, and I guess that
nvcorrd is supposed to generate these traps but can only do it if the
rulset is registered with it. When I do, and I get an event, it crashes
nvcorrd.
Is this broken? Does anyone have insight on how this is supposed to
work with NT?
--
Ray Schafer | schafer@tkg.com
The Kernel Group | Distributed Systems Management
http://www.tkg.com
|