Re: Collections in Ruleset

[Kuffer Andreas <Andreas.Kuffer@KUONI.CH>]

Thanks James, the way you described the ruleset, worked fine.
The reason for configuring it the other way around simply was 'not knowing
better' and this seemed to be the cause of my problem.

So this is the working setting:

2coll.rs:
Event Stream ->         Query Database Collection ->    Forward
block                   ID Source: Origin
                        Collection: Hubs
                        Forward: Contained in Collection

Thanks and regards...Andreas

-----Original Message-----
From: James Shanks [mailto:James_Shanks@TIVOLI.COM]
Sent: Dienstag, November 16, 1999 13:28
To: NV-L@UCSBVM.ucsb.edu
Subject: Re: Collections in Ruleset




Well, I am not sure why you did it this way, but you have given nvcorrd and
nvevents a lot of work to do.
Why set the initial node to pass when in fact you want to remove most of the
events?
Why not start off with block and the Forward only those you want to see?  By
using the negative case "Forward if not in collection" and then "resolve"
you
have effectively doubled or tripled the amount of cpu necessary to do this.
But
whether that is at the root of your problem I cannot say.   The other way,
with
block, forward if in collection, and finally Forward, is much neater and I
have
used it many times.

To find out why your ruleset is not working will require that you issue
nvcdebug -d all   while it is running and examine the nvcorrd.alog.  You
should
see the query collection being resolved as either True or False and if
False,
then there will be a message as to why.

James Shanks
Tivoli (NetView for UNIX) L3 Support



Kuffer Andreas <Andreas.Kuffer@KUONI.CH> on 11/16/99 06:33:26 AM

Please respond to Discussion of IBM NetView and POLYCENTER Manager on
NetView
      <NV-L@UCSBVM.UCSB.EDU>

To:   NV-L@UCSBVM.UCSB.EDU
cc:    (bcc: James Shanks/Tivoli Systems)
Subject:  Collections in Ruleset




hi there
I'm running AIX 4.3.2 and NetView 5.1.2. I defined a collection Hubs
(isHub=TRUE) and would like to use this collection for getting out events
only from this collection. Therefore I defined a simple ruleset named
2coll.rs:
Event Stream ->         Query Database Collection ->    Resolve
pass                    ID Source: Origin
                        Collection: Hubs
                        Forward: Not Contained in Collection

Now I do create a dynamic workspace named hubevents with correlation rule
2coll.rs. Events are coming in from hubs but also from other machines,
definitely being no hubs (isHub = FALSE) and not being member of the
Hubs-collection.

Am I doing anything wrong? Anyone also had problems on this? Are there other
ways to get events only from objects being part of a collection?

Any comments are more than welcome...Andreas

Thanks James, the way you described the ruleset, worked fine.
The reason for configuring it the other way around simply was 'not knowing better' and this seemed to be the cause of my problem.

So this is the working setting:

2coll.rs:
Event Stream ->         Query Database Collection ->    Forward
block                   ID Source: Origin
                        Collection: Hubs
                        Forward: Contained in Collection

Thanks and regards...Andreas

-----Original Message-----
From: James Shanks [mailto:James_Shanks@TIVOLI.COM]
Sent: Dienstag, November 16, 1999 13:28
To: NV-L@UCSBVM.ucsb.edu
Subject: Re: Collections in Ruleset

Well, I am not sure why you did it this way, but you have given nvcorrd and
nvevents a lot of work to do.
Why set the initial node to pass when in fact you want to remove most of the
events?
Why not start off with block and the Forward only those you want to see?  By
using the negative case "Forward if not in collection" and then "resolve" you
have effectively doubled or tripled the amount of cpu necessary to do this.  But
whether that is at the root of your problem I cannot say.   The other way, with
block, forward if in collection, and finally Forward, is much neater and I have
used it many times.

To find out why your ruleset is not working will require that you issue
nvcdebug -d all   while it is running and examine the nvcorrd.alog.  You should
see the query collection being resolved as either True or False and if False,
then there will be a message as to why.

James Shanks
Tivoli (NetView for UNIX) L3 Support

Kuffer Andreas <Andreas.Kuffer@KUONI.CH> on 11/16/99 06:33:26 AM

Please respond to Discussion of IBM NetView and POLYCENTER Manager on NetView
      <NV-L@UCSBVM.UCSB.EDU>

To:   NV-L@UCSBVM.UCSB.EDU
cc:    (bcc: James Shanks/Tivoli Systems)
Subject:  Collections in Ruleset

hi there
I'm running AIX 4.3.2 and NetView 5.1.2. I defined a collection Hubs
(isHub=TRUE) and would like to use this collection for getting out events
only from this collection. Therefore I defined a simple ruleset named
2coll.rs:
Event Stream ->         Query Database Collection ->    Resolve
pass                    ID Source: Origin
                        Collection: Hubs
                        Forward: Not Contained in Collection

Now I do create a dynamic workspace named hubevents with correlation rule
2coll.rs. Events are coming in from hubs but also from other machines,
definitely being no hubs (isHub = FALSE) and not being member of the
Hubs-collection.

Am I doing anything wrong? Anyone also had problems on this? Are there other
ways to get events only from objects being part of a collection?

Any comments are more than welcome...Andreas