Re: Filter statements in tecint.conf

[Jane Curry <jane.curry@skills-1st.co.uk>]

Hi James,
I can indeed make Filter statements work in tecint.conf.  Here is the
file:

ServerLocation=poppet
TecRuleName=forwardall.rs
ServerPort=
Filter:Class=OV_IF_Down;hostname=poppet

I can generate Interface Down traps and provided the hostname isn't
poppet, they appear in TEC.  From hostname poppet, they get filtered
out.  Same thing works on base class filters, without getting fancy
about attributes like hostname.

My NetView is a beta NetView 7.1 - hope you don't mind my reporting GOOD
functionality with early code.  Don't know if there were any changes in
this area between NV 6.x and 7.1??

Cheers,
Jane

James Shanks wrote:

>
> Jane -
>
> Are you saying that you got Filter statements to work?   I'd be very
> interested as to the details if you have, because per the man page on
> tecint.conf they are not supported.
>
> I have been in the code and while we do use the TEC EIF libraries to
> read the conf file, and then use that information to connect to the
> TEC, there is no code I saw to read the Filter entries and do anything
> with them.  So unless this is a magic feature of the TEC code, on the
> same order as the way the send routines will try each backup server in
> order, we don't even know that the filter entries are there.    As far
> as I know, the process is this, and it is dirt simple.
>
> nvserverd registers the ruleset with nvcorrd, just like he does for an
> event window.  The events which have the Forward attribute added,
> either explicitly or by default in the ruleset, are sent back to
> nvserverd, and he pulls those off his socket one at a time, formats a
> buffer with them and the info from trapd.conf, and calls the TEC
> sending routine, giving it the buffer.  What happens after that is TEC
> black magic provided by their library routines.
>
> James Shanks
> Level 3 Support
> Tivoli NetView for UNIX and NT
> Tivoli Software
> IBM Software Group
> Please note that my new id is jshanks@us.ibm.com
>
>
> ----- Forwarded by James Shanks/Raleigh/IBM on 10/19/2001 09:10 AM
> -----
>  Jane Curry
   <jane.curry@skills-1st.co.uk>                 To:        IBM NetView
   Sent by: owner-nv-l@tkg.com           Discussion <nv-l@tkg.com>
                                                 cc:
   10/19/2001 04:11 AM                           Subject:        Re:
   Please respond to IBM NetView         [NV-L] sending trap as TEC
   Discussion                            event w/o using
                                         ruleset--example?


>
> Todd,
> One other thought on this you may or may not like.  Although I have
> never seen any documentation on it, you can edit your tecint.conf TEC
> adapter file and add standard TEC filter stanzas.  This is entirely
> outside the remit of NetView and NetView rulesets but if there was a
> (TEC) class of event that you wanted to filter out, you should be able
>
> to add it to tecint.conf.  You might look at creating new TEC classes
> to
> suit your networking events and that might enhance this TEC-filtering
> idea.
>
> Be very careful if you change the config of tecint.conf via the GUI as
>
> it doesn't take any backups - just blats what is already there.  I
> guess
> James is the guy to comment on whether this is officially supported or
>
> not, though I can't see why it shouldn't be.
>
> Cheers,
> Jane
>
> --
> Tivoli Certified Enterprise Consultant & Instructor
> Skills 1st Limited, 2 Cedar Chase, Taplow, Bucks, SL6 0EU, UK
> Tel: +44 (0)1628 782565
> Copyright (c) 2001 Jane Curry <jane.curry@skills-1st.co.uk>.  All
> rights
> reserved.
>
>
> _
> _______________________________________________________________________
>
> NV-L List information and Archives: http://www.tkg.com/nv-l
>
>

Hi James,
I can indeed make Filter statements work in tecint.conf.  Here
is the file:

ServerLocation=poppet
TecRuleName=forwardall.rs
ServerPort=
Filter:Class=OV_IF_Down;hostname=poppet

I can generate Interface Down traps and provided the hostname isn't poppet, they appear in TEC.  From hostname poppet, they get filtered out.  Same thing works on base class filters, without getting fancy about attributes like hostname.

My NetView is a beta NetView 7.1 - hope you don't mind my reporting GOOD functionality with early code.  Don't know if there were any changes in this area between NV 6.x and 7.1??

Cheers,
Jane

James Shanks wrote:

 
Jane -

Are you saying that you got Filter statements to work?   I'd be very interested as to the details if you have, because per the man page on tecint.conf they are not supported.

I have been in the code and while we do use the TEC EIF libraries to read the conf file, and then use that information to connect to the TEC, there is no code I saw to read the Filter entries and do anything with them.  So unless this is a magic feature of the TEC code, on the same order as the way the send routines will try each backup server in order, we don't even know that the filter entries are there.    As far as I know, the process is this, and it is dirt simple.

nvserverd registers the ruleset with nvcorrd, just like he does for an event window.  The events which have the Forward attribute added, either explicitly or by default in the ruleset, are sent back to nvserverd, and he pulls those off his socket one at a time, formats a buffer with them and the info from trapd.conf, and calls the TEC sending routine, giving it the buffer.  What happens after that is TEC black magic provided by their library routines.

James Shanks
Level 3 Support
Tivoli NetView for UNIX and NT
Tivoli Software
IBM Software Group
Please note that my new id is jshanks@us.ibm.com
 

----- Forwarded by James Shanks/Raleigh/IBM on 10/19/2001 09:10 AM -----

Jane Curry <jane.curry@skills-1st.co.uk> Sent by: owner-nv-l@tkg.com 10/19/2001 04:11 AM Please respond to IBM NetView Discussion

To:        IBM NetView Discussion <nv-l@tkg.com>         cc:          Subject:        Re: [NV-L] sending trap as TEC event w/o using ruleset--example?

Todd,
One other thought on this you may or may not like.  Although I have
never seen any documentation on it, you can edit your tecint.conf TEC
adapter file and add standard TEC filter stanzas.  This is entirely
outside the remit of NetView and NetView rulesets but if there was a
(TEC) class of event that you wanted to filter out, you should be able
to add it to tecint.conf.  You might look at creating new TEC classes to
suit your networking events and that might enhance this TEC-filtering
idea.

Be very careful if you change the config of tecint.conf via the GUI as
it doesn't take any backups - just blats what is already there.  I guess
James is the guy to comment on whether this is officially supported or
not, though I can't see why it shouldn't be.

Cheers,
Jane

--
Tivoli Certified Enterprise Consultant & Instructor
Skills 1st Limited, 2 Cedar Chase, Taplow, Bucks, SL6 0EU, UK
Tel: +44 (0)1628 782565
Copyright (c) 2001 Jane Curry <jane.curry@skills-1st.co.uk>.  All rights
reserved.
 

_________________________________________________________________________
NV-L List information and Archives: http://www.tkg.com/nv-l