Dean -
I didn't do a big logical analysis on this because it is one of the more
complicated that I have seen. There could be a performance problem with the
first thing you are doing being a Query Collection -- think about it, you get
many traps a second and you have to query the database for each on before
continuing -- when in fact you are only interested in two kinds of traps, the
Interface Up and the Node Down. I wouldn't do it that way but it should still
work at least some of the time as long as the trap flow is not too heavy.
But you said in your earlier append that you got this from someone else who had
it working, and that you had it working in a Dynamic Workspace but not in
ESE.automation. So performance should not be an issue.
How exactly did it work before and how did it fail? Or didn't it work before?
There is nothing I can see in the rs that would account for it working in the
one situation and not the other, if you tested it by running the same events in
both cases, unless it is in the first node, the Event Stream. Double click that
in the editor. Does it say "PASS" or "BLOCK"? It should be "BLOCK".
The inline actions should create scripts in /usr/OV/tmp/@@uactions, each
subsequent one overlaying the previous one, so you can go there and check if the
last one you expected is there. The Action will be run by actionsvr and he will
log every action in his logs.
So what's in the actionsvr logs (nvaction.alog and nvaction.blog)?
If the action is not being run, then we you can trace nvcorrd ("nvcdebug -d all"
from the command line) and look in his logs as to why not, though you may need
some help reading the log for a ruleset this complicated. If you want that
level f help, then you will need to open a problem to Support.
James Shanks
Team Leader, Level 3 Support
Tivoli NetView for UNIX and NT
Dean Sullinger <DSullinger@dot.state.az.us> on 08/17/2000 03:50:13 PM
Please respond to IBM NetView Discussion <nv-l@tkg.com>
To: "'IBM NetView Discussion'" <nv-l@tkg.com>
cc: (bcc: James Shanks/Tivoli Systems)
Subject: RE: [NV-L] Ruleset for Downed Nortel Rtr
Ok, since I seam to be clueless on this, here is what I did to try and
explain better what I have setup. I grabbed a screen shot of my ruleset. I
then dumped it into Visio and made denotations on it. Then saved it out as
a JPEG. I have placed it at http://www.geocities.com/dsullinger. Could you
take a look at it and tell me where I am going wrong. Basically we need it
to inform us when a router goes down (only once do we want to be informed)
and then we need it to inform us once it is back up (here again only once).
I would also like to get it to clear the down event once it is up.
Thanks
--
Dean Sullinger
Arizona Deptartment of Transportation
Technical Information Resources Phone: (602)712-8673
Network Architecture Group
Email : dean@dot.state.az.us
SMail : 206 S. 17th Ave #110G Phx Az 85007-3212
Internet: http://www.dot.state.az.us
-----Original Message-----
From: James_Shanks@tivoli.com [mailto:James_Shanks@tivoli.com]
Sent: Wednesday, August 16, 2000 12:15 PM
To: IBM NetView Discussion
Subject: RE: [NV-L] Ruleset for Downed Nortel Rtr
First, it sounds like your ruleset is not written to be run in the
background
and you may have caused the entire events process to backup by just taking a
rule written for the foreground and sticking it in the background. Do
netstat
-a and look for sockets which have part of "nvcorrd" in their name. Do they
have large numbers in their Send and Receive queues? If so, then things are
backed up and have to be cleared. ovstop actionsvr should do that. But
don't
restart it until you have fixed the problem.
The actionsvr cannot run rulesets for very long which have a Forward in
them or
have the initial node set to PASS, as this will cause events, rather than
actions, to be sent to him. He knows how to process actions -- he builds a
script environment and runs them -- but he has no display to display events
on.
Since he cannot display them, they will just sit on his socket until it
backs
up. Then nvcorrd's socket will back up also, and the entire events process
will grind to a halt. Hopefully this rule you are using looks something
like
this:
initial event stream node (set to BLOCK) --> other nodes for logic -->
action node to log --> Forward
If so, then all you need do is make a copy of it and remove the Forward from
the
copy and use that in ESE.automation. Once that is in place, then you can
ovstart actionsvr again.
Second, you can look in /usr/OV/log/nvaction.alog and blog to see what
happens
when actionsvr gets the log action and see if there are any errors there.
Remember that a daemon does not have your defaults, so if you were using
relative path name, you may have to specify a full one, and so on.
James Shanks
Team Leader, Level 3 Support
Tivoli NetView for UNIX and NT
Dean Sullinger <DSullinger@dot.state.az.us> on 08/16/2000 02:31:50 PM
Please respond to IBM NetView Discussion <nv-l@tkg.com>
To: "'IBM NetView Discussion'" <nv-l@tkg.com>
cc: (bcc: James Shanks/Tivoli Systems)
Subject: RE: [NV-L] Ruleset for Downed Nortel Rtr
I'm sorry everyone that I keep beating on this ruleset thing, but here's
where I am today.
I have received a copy of a ruleset from one of the nice group members
(thanks Mark) that I have modified slightly for our use. The rule set
basically looks for the IBM_NVNDWN_EV or IBM_NVIUP_EV events. At that point
I have it setup to echo a response out to a log file for now just to watch
it work. If I create a Dynamic Workspace with the ruleset, I get responses
in my log file, but when I place the ruleset (actually rulesets, I need our
different OSPF areas broke down) in the /usr/OV/conf/ESE.automation file, I
get no longer receive responses. After I placed the entries in the
ESE.automation file, I did a 'ovstop actionsvr' and then a 'ovstart
actionsvr' and I'm still not getting any results.
Is there something else I need to do to get these working?
Thanks
--
Dean Sullinger
Arizona Deptartment of Transportation
Technical Information Resources Phone: (602)712-8673
Network Architecture Group
Email : dean@dot.state.az.us
SMail : 206 S. 17th Ave #110G Phx Az 85007-3212
Internet: http://www.dot.state.az.us
-----Original Message-----
From: Dean Sullinger [mailto:DSullinger@dot.state.az.us]
Sent: Thursday, July 20, 2000 2:11 PM
To: 'IBM NetView Discussion'
Subject: RE: [NV-L] Ruleset for Downed Nortel Rtr
Thanks James... I'll give this a shot next week.
Dean Sullinger
-----Original Message-----
From: James_Shanks@tivoli.com [mailto:James_Shanks@tivoli.com]
Sent: Tuesday, July 18, 2000 2:18 PM
To: IBM NetView Discussion
Subject: Re: [NV-L] Ruleset for Downed Nortel Rtr
There is nothing simple about the ruleset you have included below, at least
in
my opinion.
It includes many FieldCompares, each of which means that nvcorrd will have
to
pause his processing and query ovwdb for object information before
continuing.
That may be why it appears to stop. It also has correlation and user exits.
Looks pretty complex to me. The only way to know for sure what is going
on
would be to trace it while it runs. Issue "nvcdebug -d all" from the
command
line after you have it loaded and look at the nvcorrd.alog/blog. I also
suggest that you open a problem to Support and get some help reading the
traces.
It is very difficult for anyone to evaluate a ruleset without loading it in
the
editor to get a graphical picture of it and then looking at the traces to
see
how it runs.
As for other publications on using rulesets, you may find the redbook,
"Examples
Using NetView for AIX Version 4", SG24-4515-00, which you can get from IBM
at
http://www.redbooks.ibm.com/ .
The Admin Guide details most of the variables -- they are the contents of
the
trap -- enterprise id, origin, community name, generic id, specific id, and
all
the trap variables. The only things that are also passed to an action are
the
category and severity of the trap in trapd.conf. If you look at the
nvaction.alog/blog, you can actually see what is passed in a tilde "~"
separated
stream.
James Shanks
Team Leader, Level 3 Support
Tivoli NetView for UNIX and NT
Dean Sullinger <DSullinger@dot.state.az.us> on 07/18/2000 04:16:04 PM
Please respond to IBM NetView Discussion <nv-l@tkg.com>
To: "'nv-l@tkg.com'" <nv-l@tkg.com>
cc: (bcc: James Shanks/Tivoli Systems)
Subject: [NV-L] Ruleset for Downed Nortel Rtr
We need to create a simple ruleset that will page us when one of our Nortel
routers go down. I have tried the examples in the documentation and
continue to get information for other devices along with the routers. We
don't need to be informed when there are minor events happening with the
routers, we just need to know when they go red and when they come back to
green (up or down). I put together a ruleset (below), but it seams to work
for awhile and then stop. Also, I would like it to page us only once when
the router goes down and once when the router comes back up.
Please excuse my simplicity... I have little experience messing with the
rulesets. BTW - Is there anyplace where you can find all the different
variables that are or can be passed to an external app using the "Action"
function?
Any suggestion's where I could get any examples or ideas would be great.
Thanks
==== ruleset starts here ====
RuleSet72 RuleSet TrapID73 TrapID91
"" 0
TrapID73 TrapID NVFldCmp74 AttrJoin82
netView6000 1.3.6.1.4.1.2.6.3 "6 " "58916865 " 0 "netView6000
1.3.6.1.4.
1.2.6.3" "IBM_NVNDWN_EV Specific 58916865 " "" 0
NVFldCmp74 NVFldCmp NVFldCmp75
isPC "" "" 0 1 1 13566272 Origin 0 ""
NVFldCmp75 NVFldCmp NVFldCmp76 NVFldCmp79
"IP Status" Critical "" 0 1 1 0 Origin 0 ""
NVFldCmp76 NVFldCmp UserExit77
isIPRouter TRUE "" 0 1 1 0 Origin 0 ""
UserExit77 UserExit ForwardCorr78
"/usr/local/bin/nv_logfileDN $NVA" 0 0 0 ""
ForwardCorr78 ForwardCorr
""
NVFldCmp79 NVFldCmp UserExit80
isBayNetworksWellfleetRouter TRUE "" 0 1 1 0 Origin 0 ""
UserExit80 UserExit ForwardCorr81
"/usr/local/bin/nv_logfileDN $NVA" 0 0 0 ""
ForwardCorr81 ForwardCorr
""
AttrJoin82 AttrJoin NVFldCmp83
"" 0 "" 600 "" 0 ""
NVFldCmp83 NVFldCmp NVFldCmp84
isPC "" "" 0 1 1 0 Origin 0 ""
NVFldCmp84 NVFldCmp NVFldCmp85 NVFldCmp88
"IP Status" Normal "" 0 1 1 0 Origin 0 ""
NVFldCmp85 NVFldCmp UserExit86
isIPRouter TRUE "" 0 1 1 0 Origin 0 ""
UserExit86 UserExit ResolvedCorr87
"/usr/local/bin/nv_logfileUP $NVA" 0 0 0 ""
ResolvedCorr87 ResolvedCorr
""
NVFldCmp88 NVFldCmp UserExit89
isBayNetworksWellfleetRouter TRUE "" 0 1 1 0 Origin 0 ""
UserExit89 UserExit ResolvedCorr90
"/usr/local/bin/nv_logfileUP $NVA" 0 0 0 ""
ResolvedCorr90 ResolvedCorr
""
TrapID91 TrapID AttrJoin82.2
netView6000 1.3.6.1.4.1.2.6.3 "6 " "58916864 " 0 "netView6000
1.3.6.1.4.
1.2.6.3" "IBM_NVNUP_EV Specific 58916864 " "" 0
==== ruleset ends here ====
--
Dean Sullinger
Arizona Deptartment of Transportation
Technical Information Resources Phone: (602)712-8673
Network Architecture Group
Email : dean@dot.state.az.us
SMail : 206 S. 17th Ave #110G Phx Az 85007-3212
Internet: http://www.dot.state.az.us
_________________________________________________________________________
NV-L List information and Archives: http://www.tkg.com/nv-l
_________________________________________________________________________
NV-L List information and Archives: http://www.tkg.com/nv-l
_________________________________________________________________________
NV-L List information and Archives: http://www.tkg.com/nv-l
_________________________________________________________________________
NV-L List information and Archives: http://www.tkg.com/nv-l
_________________________________________________________________________
NV-L List information and Archives: http://www.tkg.com/nv-l
_________________________________________________________________________
NV-L List information and Archives: http://www.tkg.com/nv-l
|