Any opinions expressed in this message are those of the sender only and
do not necessarily represent the views or opinions of Woolwich plc, any
of its subsidiaries or it's associated companies. The sender may not be
authorised to give financial advice, and nothing in this message should
be construed as offering such advice. Woolwich plc is an Introducer
Firm only for Woolwich Life, Woolwich Unit Trust Managers and Woolwich
Plan Managers which are regulated by the Personal Investment Authority
for Life Assurance, Pension, Unit Trust and other Investment business.
Registered Office: Watling Street, Bexleyheath, Kent DA6 7RR.
Registered in England No.3295699
The information contained in this message and any attachments are
intended solely for the use of the individual or entity to whom they
are addressed. It may contain privileged and confidential information
and if you are not the intended recipient you must not copy, distribute
or take any action in reliance on it. If you have received this email
in error please notify the system manager ADMINISTRATOR@WOOLWICH.CO.UK
-----------------------------------------------------------------------
James,
Thanks for your suggestion.
I tried it using our test system and you are right - it blocks all the
Microsoft Enterprise IDs and it is fast!
Unfortunately it also blocks any Enterprise IDs in the range
1.3.6.1.4.1.3110-3119 and their variants which may cause a problem if we
ever receive traps from vendors using these Enterprise IDs. I guess I will
need to use some form of hybrid solution where the 'grep' is only performed
when the Enterprise Id starts with 1.3.6.1.4.1.311 (at least this will limit
the number of Inline Actions that are called).
Ken Freeman
Woolwich plc
-----Original Message-----
From: James Shanks [mailto:James_Shanks@TIVOLI.COM]
Sent: 16 November 1999 02:00
Subject: Re: Wildcards in 'Event Attributes' ruleset node
Ken -
As you have already determined, Event Attributes are an exact match only.
But
it looks to me like you are trying to
exclude by Enterprise Id, which can be done in a Trap Setting. Try defining
a
separate Enterprise ID, 1.3.6.1.4.1.311, and call it something different
than
the others (How about just "Microsoft"?) and then use that in a Trap Setting
node to block these events. It should block all matches. And it should be
pretty fast.
James Shanks
Tivoli (NetView for UNIX) L3 Support
Freeman Ken <Ken.Freeman@WOOLWICH.CO.UK> on 11/11/99 06:47:39 AM
Please respond to Discussion of IBM NetView and POLYCENTER Manager on
NetView
<NV-L@UCSBVM.UCSB.EDU>
To: NV-L@UCSBVM.UCSB.EDU
cc: (bcc: James Shanks/Tivoli Systems)
Subject: Wildcards in 'Event Attributes' ruleset node
Any opinions expressed in this message are those of the sender only and
do not necessarily represent the views or opinions of Woolwich plc, any
of its subsidiaries or it's associated companies. The sender may not be
authorised to give financial advice, and nothing in this message should
be construed as offering such advice. Woolwich plc is an Introducer
Firm only for Woolwich Life, Woolwich Unit Trust Managers and Woolwich
Plan Managers which are regulated by the Personal Investment Authority
for Life Assurance, Pension, Unit Trust and other Investment business.
Registered Office: Watling Street, Bexleyheath, Kent DA6 7RR.
Registered in England No.3295699
The information contained in this message and any attachments are
intended solely for the use of the individual or entity to whom they
are addressed. It may contain privileged and confidential information
and if you are not the intended recipient you must not copy, distribute
or take any action in reliance on it. If you have received this email
in error please notify the system manager ADMINISTRATOR@WOOLWICH.CO.UK
-----------------------------------------------------------------------
Does anyone know if it is possible to use wildcards when processing the
Enterprise Id in the 'Event Attributes' ruleset node?
The problem that I have is that I would like to exclude the Microsoft traps
from some of our processing. Unfortunately the traps do not exist in a
single Enterprise Id (1.3.6.1.4.1.311) but 20-30 different Enterprise IDs
(1.3.6.1.4.1.311.1.13.aaa.bbb.ccc....etc) due to the way that Microsoft
codes/issues SNMP traps from SMS.
The various methods I have tried are:
1) 'Inline Action' running "echo $NVE |grep -q 1.3.6.1.4.1.311."
Works, but causes the NetView/AIX to slow down as the command is
run for every alert!
2) Enterprise Id = 1.3.6.1.4.1.311.* in an 'Event Attribute' node
Doesn't work at all
3) A complicated series of 'Event Attribute' nodes testing the
Enterprise Id in different ways
Works, but messy and difficult to document!
Any help/hints would be most welcome.
Ken Freeman
Woolwich plc
|