>Well, you can try building a ruleset and see if it will give you what you
>want, but I don't see exactly how to give you all of it.
>
>Start with an Event Stream which has BLOCK as the default action. You can
>use a Node Down connected to a Reset-On-Match, with a time out of 5
>minutes, connected to a Forward and the #2 side of the Reset is your Node
>Up, matching on attribute 2 (the hostname). Then only those Node Down's
>which don't get matched within 5 minutes will go to the window. But the
>Node Ups will not go at all unless you explicitly connect them to the
>Forward. But then you will get all Node Ups regardless of whether they
>were used in a match or not. There is no getting around that so far as I
>can see.
Hi,
I noticed the same when I was trying to build a ruleset. It seems there is
no way to do what I want. I wanted to be sure that I was not doing
something wrong.
>
>I don't understand what you are asking about attributes in the Events
>window. Almost everything you see there is customizable. You use xnmtrap
>to configure the Log Message in trapd.conf to change what you see. The man
>page on trapd.conf will explain what all the variables such as $A, $C, and
>$1 - $50 mean and how to use them to display whatever parts of the trap you
>want. This is all explained in the Administrator's Guide, too.
>
When you look at the Events window you see a list of events (or presented
by cards). I ment such attributes like: date (day, month, hour), host name,
source (for instance "N") and a message formatted in trapd.conf. I know
that I can customise the last part of that event i.e the message. I can put
there my own message including a set of variables. But I would like for
instance not to display source or hostname (the hostname could be included
in the message part).Can I do this?
Regards and thank you for any advice,
________________________________________________________________
Szymon Trocha
POZNAN SUPERCOMPUTING & NETWORKING CENTER
Tel. (+48 61) 8582022
http://noc.man.poznan.pl
|