Hi Jon, hope things are going well for you. Give my regards to the rest
of the team.
I can give you a couple of points which are just my opinion.
1. If you are taking actions that requires no other trap correlation, then
do it outside of a ruleset. Try to make your scripted process something
that gets done quickly and returns. I have used scripts to regenerate
traps using this method and in a decent machine was able to easily process
20,000 trap bursts in a few minutes in a test environment. Make sure
your scripts (if you have multiple) can all be executing at the same time
and is not trying to update the same file at the same time.
2. For the ruleset that is called to forward events to TEC, it should
have absolutely NO action blocks in that ruleset.
3. Any ruleset that has action blocks should be called from
ESE.automation. This ruleset should have a default box of BLOCK...and
have absolutely no FORWARD EVENT blocks. All event streams should end in
a BLOCK box after all actions have taken place.
Kind regards,
Stephen Hochstetler shochste@us.ibm.com
International Technical Support Organization - Austin
Office - 512-436-8564 FAX - 512-436-8701
ITSO redbooks at http://www.redbooks.ibm.com
|