A ruleset that runs in the background cannot directly influence the display
of any user.
Your override changed the severity of the event as you processed it, so it
had a new severity going to your action but that is all. The other users'
workspaces, presumably running forwardall.rs, received the original copy
of the event unchanged from what trapd made it. If the purpose of the
override was to change the user display, I am afraid it won't do it this
way. Your override and forward would have to be tied to a display.
The best way to think of what's in ESE.automation is to remember that the
actionsvr daemon runs them. His processing, like that of other users, is
independent from them. The real reason to use it is to have things happen
"in the background" whether anyone has an Events GUI up or not. It is
useful for issuing pages, logging things, initiating new processes,
sending out e-mail or new events, but it cannot directly modify what other
users' see.
James Shanks
Team Leader, Level 3 Support
Tivoli NetView for UNIX and NT
moshe_asseo@il.ibm.com@tkg.com on 07/01/2001 08:45:11 AM
Please respond to IBM NetView Discussion <nv-l@tkg.com>
Sent by: owner-nv-l@tkg.com
To: IBM NetView Discussion <nv-l@tkg.com>
cc:
Subject: Re: [NV-L] Ruleset problem
Hello,
I have the following rulset -
Event Stream ->Event Attributes -> Query Database Field
-> Override -> Forward -> Action
In the override section I am changing the severity of the event from minor
to major.
When moving this rulset to background ( update in ESE.automation ), I
omitted the forward, but now the severity doesn't change in the Event
display.
Can anybody tell me what should I do ?
James,
perheps you have an idea since you were very precise on this clarification.
Best regards,
Moshe' Asseo.
Technical support group
IBM Global Services Israel
-------------------------------------------
Tel. 972-3-5316820 , Ext. 6820 , Mobile: 972-50-369245 ,
Fax.972-3-5313580
E-Mail: moshe_asseo@il.ibm.com
"James Shanks" <SHANKS@us.tivoli.com> on 06/28/2001 04:58:16 PM
Please respond to IBM NetView Discussion <nv-l@tkg.com>
To: IBM NetView Discussion <nv-l@tkg.com>
cc:
Subject: Re: [NV-L] Ruleset problem
"Resolve" does not work in the background. It is a command only to the
event display and actionserver does not have one of those, so it does
nothing.
James Shanks
Team Leader, Level 3 Support
Tivoli NetView for UNIX and NT
moshe_asseo@il.ibm.com@tkg.com on 06/28/2001 09:03:42 AM
Please respond to IBM NetView Discussion <nv-l@tkg.com>
Sent by: owner-nv-l@tkg.com
To: IBM NetView Discussion <nv-l@tkg.com>
cc:
Subject: Re: [NV-L] Ruleset problem
James,
Your item 1 below is very helpfull.
I understand that before handover any ruleset to ESE.automation you should
remove any "forward", "resolve" and change "pass" to "block", am I right ?
Could you say what whould you use instead of "resolve", what will happen
when working in background ?
Best regards,
Moshe' Asseo.
Technical support group
IBM Global Services Israel
-------------------------------------------
Tel. 972-3-5316820 , Ext. 6820 , Mobile: 972-50-369245 ,
Fax.972-3-5313580
E-Mail: moshe_asseo@il.ibm.com
"James Shanks" <SHANKS@us.tivoli.com> on 28/06/2001 13:23:41
Please respond to IBM NetView Discussion <nv-l@tkg.com>
To: IBM NetView Discussion <nv-l@tkg.com>
cc:
Subject: Re: [NV-L] Ruleset problem
Rulesets in ESE.automation are loaded by the actionsvr daemon. When you
change what is in ESE.automation then you must re-start actionsvr to get
him to re-read that file and register those rulesets with nvcorrd.
actionsvr has his own logs, /usr/OV/log/nvaction.alog/blog. In there you
can watch him do the load and you can watch him attempt to execute any
Action node from your ruleset (as opposed to inline actions which are done
by nvcorrd).
Answers to minor questions.
1. actionsvr is a daemon with no display. What he knows how to do is
execute actions, command, using the events passed to him as arguments. If
you use a Forward in a ruleset run by actionsvr, then he gets the event
data but no action and does not know what to do with this data sitting on
his input queue, so it lays there. Eventually the queue fills up,
actionsvr stops processing, and then nvcorrd's output queue to him fills
up, and he stops processing, and you have hung the entire mechanism. For
this reason, rulesets run in the background should not contain a Forward, a
Resolve (which is just a special case of Forward), or have their initial
node set to PASS rather than BLOCK.
2. The ruleset editor creates a temporary copy of your ruleset every time
you edit it, so that you can blow away your changes at the last minute. He
takes the current file, say "aaa.rs" and makes a backup copy, "aaa.rs.BAK",
and one called "aaa.<random_character_string>" as the temp copy. This copy
is removed if the editor is exited normally . If the editor is killed and
the copy remains, you can just delete it.
James Shanks
Team Leader, Level 3 Support
Tivoli NetView for UNIX and NT
"Chan, Jack" <jack.chan@nz.unisys.com>@tkg.com on 06/28/2001 12:57:00 AM
Please respond to IBM NetView Discussion <nv-l@tkg.com>
Sent by: owner-nv-l@tkg.com
To: "'IBM NetView Discussion'" <nv-l@tkg.com>
cc:
Subject: [NV-L] Ruleset problem
I was playing around with rulesets, and I have a question:
I removed ruleset A in ESE.automation, and put ruleset B in ESE.automation.
And I did a ovstop and ovstart.
My /log/nvcorrd.alog file, shows:
001/28/06 16:49:36 ./nl_nvcorrd.C[944] : ><************ nvcorrd
starting
*************
2001/28/06 16:49:36 ./nl_nvcorrd.C[945] : ><nvcorrd level:11/13
2001/28/06 16:49:36 CorrelationDef.C[186] : Open error for ruleset
load:/usr
/OV/conf/rulesets/A.rs
It seems like it was trying to load up ruleset A, which I don't want!!
How can I fix this??
Some minor questions:
1. In the administrator guide it says, Do not put a forward node in the
ruleset started in ESE.automation, why?
2. Sometimes under /usr/OV/conf/ruleset, I have A.rs, and some funny files
like A.rs12Y123 A.rs80r35, etc. why?
thanks a lot, Jack.
_________________________________________________________________________
NV-L List information and Archives: http://www.tkg.com/nv-l
_________________________________________________________________________
NV-L List information and Archives: http://www.tkg.com/nv-l
_________________________________________________________________________
NV-L List information and Archives: http://www.tkg.com/nv-l
_________________________________________________________________________
NV-L List information and Archives: http://www.tkg.com/nv-l
_________________________________________________________________________
NV-L List information and Archives: http://www.tkg.com/nv-l
|