Ken -
As you have already determined, Event Attributes are an exact match only. But
it looks to me like you are trying to
exclude by Enterprise Id, which can be done in a Trap Setting. Try defining a
separate Enterprise ID, 1.3.6.1.4.1.311, and call it something different than
the others (How about just "Microsoft"?) and then use that in a Trap Setting
node to block these events. It should block all matches. And it should be
pretty fast.
James Shanks
Tivoli (NetView for UNIX) L3 Support
Freeman Ken <Ken.Freeman@WOOLWICH.CO.UK> on 11/11/99 06:47:39 AM
Please respond to Discussion of IBM NetView and POLYCENTER Manager on NetView
<NV-L@UCSBVM.UCSB.EDU>
To: NV-L@UCSBVM.UCSB.EDU
cc: (bcc: James Shanks/Tivoli Systems)
Subject: Wildcards in 'Event Attributes' ruleset node
Any opinions expressed in this message are those of the sender only and
do not necessarily represent the views or opinions of Woolwich plc, any
of its subsidiaries or it's associated companies. The sender may not be
authorised to give financial advice, and nothing in this message should
be construed as offering such advice. Woolwich plc is an Introducer
Firm only for Woolwich Life, Woolwich Unit Trust Managers and Woolwich
Plan Managers which are regulated by the Personal Investment Authority
for Life Assurance, Pension, Unit Trust and other Investment business.
Registered Office: Watling Street, Bexleyheath, Kent DA6 7RR.
Registered in England No.3295699
The information contained in this message and any attachments are
intended solely for the use of the individual or entity to whom they
are addressed. It may contain privileged and confidential information
and if you are not the intended recipient you must not copy, distribute
or take any action in reliance on it. If you have received this email
in error please notify the system manager ADMINISTRATOR@WOOLWICH.CO.UK
-----------------------------------------------------------------------
Does anyone know if it is possible to use wildcards when processing the
Enterprise Id in the 'Event Attributes' ruleset node?
The problem that I have is that I would like to exclude the Microsoft traps
from some of our processing. Unfortunately the traps do not exist in a
single Enterprise Id (1.3.6.1.4.1.311) but 20-30 different Enterprise IDs
(1.3.6.1.4.1.311.1.13.aaa.bbb.ccc....etc) due to the way that Microsoft
codes/issues SNMP traps from SMS.
The various methods I have tried are:
1) 'Inline Action' running "echo $NVE |grep -q 1.3.6.1.4.1.311."
Works, but causes the NetView/AIX to slow down as the command is
run for every alert!
2) Enterprise Id = 1.3.6.1.4.1.311.* in an 'Event Attribute' node
Doesn't work at all
3) A complicated series of 'Event Attribute' nodes testing the
Enterprise Id in different ways
Works, but messy and difficult to document!
Any help/hints would be most welcome.
Ken Freeman
Woolwich plc
|