Hi list,
I am trying to write a ruleset to accomplish the following:
- if we receive an Interface Down and then an Interface Up trap for the
same device: both trap are resolved
- if we receive an Node Down and then an Node Up trap for the same device:
both trap are resolved
- if we receive an Interface Down and then a Node Down for the same device:
the interface down is resolved and only the Node Down trap appear in the
event viewer.
- if we receive an Interface Up and then a Node Up for the same device: the
interface Up is resolved and only the Node Up trap appear in the event
viewer.
For the two first items it's very easy to accomplish with a "Pass on match"
and a resolve.
However, the resolve function remove both trap and for the "Interface
Up"/"Node Up" trap, I want the most "global" one (Node Up) to stay in the
event viewer and only the "Interface Up" to be resolved.
How am I supposed to accomplish that ?
I tried with a second "trap setting" after the "Pass on match" but it
doesn't seams to work the way I want. I would even say that the result is
inconsistent because from time to time, some of the events I generate don't
go through at all. I am using different event viewer to compare between
"forwardall" and my ruleset.
Here is my ruleset:
(See attached file: ruleset.rc)
Did some of you have more success to accomplish the same or similar ?
Thanks
Regards,
Francois Le Hir
Network Projects & Consulting Services
IBM Global Services
Phone: (514) 205 6695
ruleset.rc
Description: Binary data
|