In the usual case, there is little difference between one large rule and several
small ones, though the latter case is easier to maintain. The only time I have
ever seen a difference is an extreme situation, where over 30 smallish rules
were instituted at once and the trap rate was exceedingly high, over 10 per
second. In that case you could actually measure a difference in the time it
took to consider a new rule as opposed to a new path in an existing rule, but it
was still quite small. I usually advise folks to break their processing into
smaller units for easier maintenance.
As for fault correlation by rulesets, you are correct that this is not easily
accomplished. That is one reason why Tivoli sells its Tivoli Network
Connectivity Manager, and why that is being enhanced for Version 6.
James Shanks
Tivoli (NetView for UNIX) L3 Support
Patrick McNeil <patrick_mcneil@yahoo.com> on 01/27/2000 01:55:12 PM
Please respond to patrick_mcneil@yahoo.com
To: NV-L@UCSBVM.UCSB.EDU
cc: (bcc: James Shanks/Tivoli Systems)
Subject: Question about large rules
Hello,
I have been busy implementing several rules have a couple of questions
regarding the rules. First off, I have the following rules:
1. Node down to Node up
2. Interface down to Interface up
3. Interface down to Node down
4. Interface up to node up
5. Cisco Dial-backup line detection (i.e. dial backup is active for a
location).
All of the above rules are working for our site.
My questions are:
1. Is there any performance difference between having a single rule that
contains all the rules above vs. having 5 different rules to be processed?
2. Is anyone doing some fault correlation type rules? What I mean by that
is if Router A is behind Router B and Router B goes down, don't page on
Router A. I have been working on solving that problem and have not been
able to come up with an easy way of doing this.
Any suggestions would be appreciated.
Patrick
|