Thanks for your reply, James. I can match only parts of what you are saying
to what I am seeing. Your suggested starting point is pretty much where I
began. I created a dynamic workspace for Critical and Major events with no
time interval spec'd and to include all nodes. In the Current window there
were 7 Critical events generated within the last hour, but only the 2 most
recent showed up in the new dynamic workspace. Since ovevent.log is a binary
file, I can't compare the two to see what really should there. The current
size of ovevent.log is only 68K, the .BAK only 132K. Creating a dynamic
workspace based on severity should have shown me all 7 criticals and any
other matcheing events that were in the Current workspace. New events are
coming in to the new workspace, so at least that much is working.
We're looking to build dynamic WS's for specific things that go back X
time/events in history and keep updating with new events that pass the
filter. This seems to be the sticking point with dynamic workspaces, they
can't go back in time past some very recent point (< 1 hr.?). It doesn't
make sense for my operators to have to create two different workspaces to
accomplish one task. Is this even possible in NetView? I am probably missing
something in building WS's, but that's the way it's shaping up.
Beyond that, I still can't find the reason that creating a Historical WS
with no filters active displays 20-odd events from Sept. 21. Trapd.log is
full of current events.
Regards,
Steve Elliott
Sr. Network Mgmt. Engineer
epicRealm, Inc.
214-570-4560
-----Original Message-----
From: James_Shanks@TIVOLI.COM [mailto:James_Shanks@TIVOLI.COM]
Sent: Monday, October 09, 2000 11:24 AM
To: IBM NetView Discussion
Subject: Re: [NV-L] Event History
Event History has nothing to do with trapd.log. It reads what is in
/usr/OV/log/ovevent.log. The biggest size this can be is 2MB, ad when this
is reached, old events are replaced with newer ones.
I would try it by starting it without any filters and then apply them.
I'll bet the evens you want are not in ovevent.log any longer. Events
History should have been called "Recent Events History" because in most
busy shops it will not hold even a day's worth of old events. The
purpose was just to show an operator what he might hav missed from the
previous shift. It was not designed to go back any farther. Historical
analysis has to be done on trapd.log, which you can archive and browse as
you see fit.
James Shanks
Team Leader, Level 3 Support
Tivoli NetView for UNIX and NT
Stephen Elliott <selliott@epicrealm.com> on 10/09/2000 12:08:22 PM
Please respond to IBM NetView Discussion <nv-l@tkg.com>
To: "'nv-l@tkg.com'" <nv-l@tkg.com>
cc: (bcc: James Shanks/Tivoli Systems)
Subject: [NV-L] Event History
All,
I'm having a great time trying to get Event History to work with a filter
specific to certain address ranges. When activated and a query made,
nothing
shows up in the workspace. If I change the Object Identification field to
pass events from all objects, I still get nothing. I've specified a period
of the last 2 days and I've confirmed that there are valid target events in
trapd.log for this timeframe. I've included the filter rules below. If
anyone can spot an error, please let me know.
For all events:
PRESENT=SNMP_TRAP && (LOGGED_TIME>=07:10:00:00:00:00) &&
(LOGGED_TIME<=09:10:00:15:37:00)
For events from specific nodes in 2 address ranges:
PRESENT=SNMP_TRAP && ((IP_ADDR=10.24.0.*) || (IP_ADDR=63.*.*.*)) &&
(LOGGED_TIME>=07:10:00:00:00:00)
&& (LOGGED_TIME<=09:10:00:15:37:00)
Are there known bugs regarding Event History that might account for this
problem?
Regards,
Steve Elliott
Sr. Network Mgmt. Engineer
epicRealm, Inc.
214-570-4560
_________________________________________________________________________
NV-L List information and Archives: http://www.tkg.com/nv-l
|