jdennison@tc.faa.gov (Jeff CTR Dennison) writes:
> I have inherited maintenance of a series of small (25 IP addresses)
> systems with a NetView based monitoring and control workstation at
> each of 20 sites. Approximately 5 or 6 times each day at each site
> NetView displays a message such as "Interface eth0 (or eth1 or Fddi0)
> down" for some processor or router port. These traps are set up using
> ovxbeep to post an alarm that must be manually acknowledged. However,
> the processor or port is not actually down. The system being
> monitored is a real-time, life critical system with personnel manning
> the monitoring position 24/7. The problem is that the monitoring
> personnel have beome used to ignoring the alerts and just clicking
> them off because they are almost always false alarms and they are now
> complaining about the high number of false alarms. This is a bad
> situation in a life critical environment.
>
> Although I have very little actual NetView expertise I have been told
> that the traps can be filtered so that the trap would only be
> displayed if if happened twice during some time period or twice in a
> row, or something similar.
>
> I'm hoping someone can either help in how this filtering might be done
> or point me to a good reference source.
It sounds like you're in need of a crash course on the NetView ruleset
editor.
Rulesets allow you to massage alerts in a variety of ways, including
the way you mention. You evidently have an existing ruleset that pops
up the ovxbeep alert for these specific traps you're receiving.
You would modify your ruleset to perhaps include a "Thresholds"
element with a Type of "After" specifying a Count of 2, for
instance. See page 185 of the Netview 6.0 for UNIX Administrator's
Guide.
--
|