Hi Todd,
I love Leslie's suggestion to create your own source letter and then have a
simple ruleset that forwards to TEC based on that.
For answers to your specific questions, please see my inserts.
Cheers,
Jane
"Todd H." wrote:
> Greetings,
>
> I'd like to eliminate some branches from my correlation rulesets--for
> example, sending a TEC event in response to a simple trap. Hertofore,
> I've done this with "trap settings" nodes followed by "Forward"
> nodes--and the size of the ruleset soon became well, very large for
> the wide variety of traps we're supporting.
Do you know that you can create rulesets of rulesets? Rather than having one
huge ruleset, create ones of manageable size and then create an overall
ruleset using the File -> Import menus.
>
>
> I've recently learned that you can configure this simple forwarding of
> traps as TEC events without loading down the ruleset correlation
> engine--but would like to know how. In the Event Configuration
> settings, I know how to assign TEC slots, and event message formats.
> I'm just not sure what external command string to specify on that
> window (Options>EVent Configuration> Trap Customization SNMP, select a
> trap, then ModifyEvent)
>
The TEC-related boxes in the middle of your "Modify Event" customisation
window specify the mapping of SNMP TRAPs to TEC events - WHAT events are
forwarded is still controlled by the TEC adapter nvserverd customisation,
which needs a NetView ruleset (check /usr/OV/conf/tecint.conf for these
parameters).
>
> Question 1) "Forward trap" setting -- what does this do?
This is ONLY for forwarding SNMP TRAPs to another SNMP manager - nothing to
do with forwarding to TEC.
>
>
> Question 2) "Command for Automatic Action" - I'm sure that wpostemsg
> or postemsg is involved, but I think I just need an example that shows
> how/what environment variables are required or implied so the TEC
> adapter passes a TEC event with the message slots populated as
> desired.
>
You could use (w)postemsg here - you can find the available TRAP parameters
easily by simply clicking the "Help" button from that "Modify Event" panel -
they're all documented under the "Event Log Message" entry but they are just
as valid used by the "Command for Automatic Action" - there's also a little
example.
>
> Question 3) What daemon forks off the action in Command for Automatic
> Action? Actionsrv? Or something else?
actionsvr is the daemon that handles actions from rulesets; ovactiond is the
daemon that handles the "Command for Automatic Action".
>
> TIA for any insight or advice.
>
> --
> Todd H.
> http://www.toddh.net/
> _________________________________________________________________________
> NV-L List information and Archives: http://www.tkg.com/nv-l
--
Tivoli Certified Enterprise Consultant & Instructor
Skills 1st Limited, 2 Cedar Chase, Taplow, Bucks, SL6 0EU, UK
Tel: +44 (0)1628 782565
Copyright (c) 2001 Jane Curry <jane.curry@skills-1st.co.uk>. All rights
reserved.
|