Well, I have not worked with global acknowledge so I cannot comment on how
it works, but two of the three things you find strange are standard
behavior for trapd, and I have commented on them before.
First, there is code in trapd to format any NetView event whether it has an
explicit format in trapd.conf or not. This is so that you cannot screw up
the workings of netmon and ipmap and other NetView internal processes that
receive traps by deleting the entries for NetView traps out of trapd.conf.
So there is no mystery why the new traps formats even though there is no
explicit entry for it.
Second, trapd.log is always one trap behind but usually you will not notice
it. The log entry is already written internally but to save cycles it is
not written to the file until the next trap is processed. You can see this
behavior on a test system by stopping netmon and just playing with
snmptrap. So there is no mystery in your testing there either. You just
haven't noticed that trapd.log will be "one behind" unless the flow of
traps is more or less constant, which it usually is. But the formatted
trap is passed to the event window immediately so that the GUI is not
behind. But that timeliness is bought with considerable overhead.
But I cannot answer as to why you would see two traps in trapd.log. That
would require investigation and that I haven't the time for at the moment.
I cannot imagine how, since trapd simply doesn't know how to process a trap
twice. That's all I can say at this time.
James Shanks
Team Leader, Level 3 Support
Tivoli NetView for UNIX and NT
Jane Curry <jane.curry@skills-1st.co.uk>@tkg.com on 05/30/2001 05:50:01 PM
Please respond to IBM NetView Discussion <nv-l@tkg.com>
Sent by: owner-nv-l@tkg.com
To: NetView mailing list <nv-l@tkg.com>
cc:
Subject: [NV-L] ACK_EV traps
I am a little puzzled by the mechanism of the ACK_EV and UNACK_EV
events.
We have global acknowledge configured. If you ACK a node, you can see
an event at the end of trapd.log - it always come from the NetView
system, whichever node has been ACKed - I guess I can cope with this as
it is NetView that is taking an action and is notifying us.
Stranger, is that that the ACK event is NOT (by default) customised into
trapd.conf, yet we don't get a "Trap found in unknown format" event.
You can customise the event into trapd.conf if you want - then you see 2
in trapd.log and 2 in the event workspace (both the same trap; one with
the netview hostname and one with a blank hostname).
Stranger still, whether you customise the ACK / UNACK events in
trapd.conf or not, if you tail trapd.log, ACK and UNACK events are
always 1 behind ie. send an ACK, see nothing in trapd.log, send an
UNACK, you see the first ACK, send a second UNACK & you see the first
UNACK, - and so on. Yet, if you have customised them into trapd.conf,
they appear immediately in an event workspace.
Is this working as designed?? If so, please could anyone elucidate on
the design?
Many thanks,
Jane
--
Tivoli Certified Enterprise Consultant & Instructor
Skills 1st Limited, 2 Cedar Chase, Taplow, Bucks, SL6 0EU, UK
Tel: +44 (0)1628 782565
Copyright (c) 2001 Jane Curry <jane.curry@skills-1st.co.uk>. All rights
reserved.
_________________________________________________________________________
NV-L List information and Archives: http://www.tkg.com/nv-l
|