[nv-l] netview - detecting event storms?

[dmahler@telcordia.com]

Well, we had another incident recently
where a core switch had a problem and the VLAN where netview was living
got affected.   Netview ended up thinking that the world was ending
and sent out hundreds of alerts to TEC - this flooded the TEC and made
many people unhappy. 

I have tried many things through the
years to address these sorts fo things, including re-pings and retests,
alert rate thresholds, page suppression by reporter ("stop all the
paging for netview")....etc...  Have had some success, but...
 I have not come up with a solid way to make netview behave 
in a common sense way: " when it
looks like you cannot get anywhere, don't assume the entire network has
gone down".   I was wondering if other had faced the same issues
and had any other ideas.   

My setup is that I have a series of
mid-level managers (MLM's - netview , spectrum, others) feeding tivoli
TEC(s).   I would prefer to handle this in the MLM's, rather than
write a lot of TEC rules (dependency clauses and fact files), since this
means that TEC has to get very busy in processing the flood....  
 ideas?  Other techniques? 


thanks for any suggestions,


Don Mahler
SAIC 


ps On a related question, is there yet
a rule writer for netview (windows), similar to what used to exist for
netview/aix?