Attached are two rulesets we use. We only page on the FIRST "Interface
down" event for the node and the corresponding "Node up" event for the same
node. The rules are configured to only page after the interface is down for
15 minutes (is configurable). A NV field is set in the database for the
node in question when an interface is down for more than 15 minutes. This
way the "Node up" event in the second rule will check this NV field to see
if it should send a page (i.e., you do NOT want to page when a new node is
added ("Node up" is generated in this case), but you DO want to send a page
for "Node up" when a corresponding page for "Interface up" has already been
sent). We then execute an "Action" that executes a PERL script. Our PERL
script calls TelAlert, which then does the paging.
Joe Prokott
Network Architect
West Group
phone: 651-687-4536
e-mail: joe.prokott@westgroup.com
-----Original Message-----
From: Matt Ashfield [mailto:mda@UNB.CA]
Sent: Tuesday, January 18, 2000 8:49 AM
To: NV-L@UCSBVM.UCSB.EDU
Subject: Re: Sending Interface Down & Interface up pages and correlation
Hi All,
This seems to be a very common question coming up. Correlating the Interface
Down and Interface Up traps during a specified time. Maybe someone who has a
working ruleset could post it to the forum? Just a thought, as this is a
common thing most people would like to do.
My way of doing things seems a bit convoluted now. I do the following:
- Check for interface down events. If no interface up trap is received after
x minutes, run a Perl script that sends an email and places that node in the
"down-database"
- Run a Perl script every x minutes that pings the nodes in the
"down-database". Presumably, each node in that database is still down. Send
an email stating that it is still down.
- For an interface up trap, run a Perl script that checks to see if that
interface is in the "down-database". If it is, send an email stating it is
now up, and remove it from the down-database.
I guess the only advantage to using scripts like I do would be that a notice
is emailed every x minutes stating that the node is sitll down (I vary the
notifications based on the criticality (is that a word?) of the node, and
the time of day).
Just my $.02
Matt
mda@unb.ca
-----Original Message-----
From: Patrick McNeil <patrick_mcneil@yahoo.com>
To: NV-L@UCSBVM.UCSB.EDU <NV-L@UCSBVM.UCSB.EDU>
Date: Tuesday, January 18, 2000 10:36 AM
Subject: Re: Sending Interface Down & Interface up pages and correlation
>OK. I did like Steve suggested and that worked (after correctly altering
>the up message). I guess I had gotten hung up at trying make the Interface
>Up message send out as opposed to just sending an all clear message with
the
>appropriate data.
>
>Thanks for everyone's help.
>
>Patrick
>
page_nodeupdown.rs
Description: Binary data
page_up_nodeupdown.rs
Description: Binary data
|