gavin!
please stop hammering for a moment. we suffer from similar problems and have
implemented MLM on our netview box. we are very satisfied with this
workaround! there is a redbook containing a useful description on how to
implement MLM as a trap filter (sorry, can't remember the name of the
book...).
I have spent only few hours for installation and basic filter setup.
basically, if you install MLM from the netview CD it will grab port 162
(kind of unfriendly take-over or trapd). you have to change trapd's port
manually, to e.g. 165. second step is to configure MLM (via GUI) to forward
traps to port 165. third step is to set up filters on what is to be blocked
or to be forwarded.
I guess, everbody will agree that the best approach in an ideal world would
be trap suppression on the SNMP agent but even that won't prevent you from
unpredictable "trap storms". MLM has turned out as an efficient emergency
brake.
hth,
richard
-----Ursprüngliche Nachricht-----
Von: Gavin Newman [mailto:NEWMANGJ@banksa.com.au]
Gesendet: Freitag, 04. Mai 2001 01:33
An: nv-l@tkg.com
Betreff: Re: [NV-L] NetView trap load
Thanks for the feedback - timely as usual.
My major problem is that the company I work for was taken over by a larger
company and they seem to suffer from selective deafness, advice from their
staff is deemed more "important" than that from staff from the vanquished
company despite my 30 years experience in the IT business.
I keep hammering my head against the wall because it feels so good when I
stop!
Cheers from the trenches - Gavin
>>> James_Shanks@tivoli.com 03/05/2001 21:17:53 >>>
Changing to Ignore does nothing to reduce the work load on trapd. It just
suppresses logging which is the last thing that is done. 90% of the work
still remains, and worse yet, trapd is not processing your important traps
while he is busy dealing with the trash, so everything is delayed.
Your only solution to this problem if you cannot reduce the flow is to
implement an MLM as a trap receiver, and have him forward to NetView only
what you deem important. Use him to filter what trapd gets. If you are
careful you can implement them both on the same box by changing the ports
trapd listens to.
Doesn't your management care about the wasted bandwidth and denial of
service to your real users that floods of worthless traps cause? That kind
of argument is usually more persuasive.
James Shanks
Team Leader, Level 3 Support
Tivoli NetView for UNIX and NT
"Gavin Newman" <NEWMANGJ@banksa.com.au>@tkg.com on 05/03/2001 03:27:06 AM
Please respond to IBM NetView Discussion <nv-l@tkg.com>
Sent by: owner-nv-l@tkg.com
To: <nv-l@tkg.com>
cc:
Subject: [NV-L] Netview trap load
Hi again
Still chasing up why my Netview system is missing events due to excessive
traps coming in. I am trying to get the Netware "gurus" to stop sending me
non-important traps (120,000+ per day!) but its hard work getting it done
as there are so many servers out there.
I have a large number of traps defined in my trapd.conf file as "Ignore
Events" so I don't really know how many of these Netview is having to
process and was intending to set them to be "Log Only Events" to try and
get a handle on this, the question that arises is how much processing does
Netview have to do for and "Ignore Events" trap? Does it pass these by the
rules engine etc or are they dropped very early in the process?
Will I make my system even worse by logging thes traps?
Cheers - Gavin Newman
**********************************************************************
***** IMPORTANT INFORMATION *****
This document should be read only by those persons to whom
it is addressed and its content is not intended for use by
any other persons. If you have received this message in
error, please notify us immediately. Please also destroy and
delete the message from your computer. Any unauthorised form
of reproduction of this message is strictly prohibited.
Bank SA is not liable for the proper and complete transmission
of the information contained in this communication, nor for any
delay in its receipt.
**********************************************************************
_________________________________________________________________________
NV-L List information and Archives: http://www.tkg.com/nv-l
_________________________________________________________________________
NV-L List information and Archives: http://www.tkg.com/nv-l
|