I'll take a stab.
Possible: Yes
Implementation method depends on (but not limited to) the following things
in the real world:
Positioning of MLM
Platform of MLM(OS flavour)
Platform of NetView server(OS flavour)
Network topology
I have 2000 remote sites with MLMs on NT filtering their local events before
sending over WAN to the Unix NetView server, killing two stones with one
bird.....
An MLM dispersed at remote sites is ideal, in addition to a local MLM for
locally generated events. Whether you run it on the same system as the
NetView server depends on you.
MLM installation method(remote or hands-on depending on MLM platform)
Ability to utilize APM (runs only on NetView for Unix).
The more MLMs you deploy make the APM crucial. The APM will not make MLM
deployment easier, but the implementation of filtering much more efficient.
Having said all that, you failed to mention environment specifics which will
dictate how MLM/filtering is implemented at your site. Hope this sheds some
light for you.
-----Original Message-----
From: Luc BARNOUIN [mailto:luc.barnouin@thalesatm.com]
Sent: Thursday, July 19, 2001 10:21 AM
To: IBM NetView Discussion
Subject: [NV-L] MLM ThrottleTraps filtering
Hi MLM specialists,
I never used MLM, but I am studying a way of preventing trapd being overload
with unsollicited
traps, and as discussed before, if no action is possible at the agent level,
MLM seems to be a good
solution.
The problem is to prevent an overload, i.e. filter traps from an agent if
the flow is greater from a
predefined threshold.
It seems that the throttle fields of the MLM filter table could help in
doing that, but I did not
understand very well the use of Arm Count, Armed Command in combination with
Disarm Timer or Disarm
Count and Disarm Command...
Typically, what I would like to perform :
If the number of trap from the same host is greater than 10 within 5 sec =>
activate filter
Deactivate filter when trap flow is lower than 1 trap / 2 sec
Is that possible, and how would it be implemented?
Thanks for your help
|