[Top] [All Lists]

[nv-l] netview - detecting event storms?

To: nv-l@lists.tivoli.com
Subject: [nv-l] netview - detecting event storms?
From: dmahler@telcordia.com
Date: Tue, 1 Jul 2003 08:55:51 -0400
Delivered-to: mailing list nv-l@lists.tivoli.com
Delivery-date: Tue, 01 Jul 2003 13:57:46 +0100
Envelope-to: nv-l-archive@lists.skills-1st.co.uk
List-help: <mailto:nv-l-help@lists.tivoli.com>
List-post: <mailto:nv-l@lists.tivoli.com>
List-subscribe: <mailto:nv-l-subscribe@lists.tivoli.com>
List-unsubscribe: <mailto:nv-l-unsubscribe@lists.tivoli.com>
Mailing-list: contact nv-l-help@lists.tivoli.com; run by ezmlm

Well, we had another incident recently where a core switch had a problem and the VLAN where netview was living got affected.   Netview ended up thinking that the world was ending and sent out hundreds of alerts to TEC - this flooded the TEC and made many people unhappy.

I have tried many things through the years to address these sorts fo things, including re-pings and retests, alert rate thresholds, page suppression by reporter ("stop all the paging for netview")....etc...  Have had some success, but...  I have not come up with a solid way to make netview behave
in a common sense way: " when it looks like you cannot get anywhere, don't assume the entire network has gone down".   I was wondering if other had faced the same issues and had any other ideas.  

My setup is that I have a series of mid-level managers (MLM's - netview , spectrum, others) feeding tivoli TEC(s).   I would prefer to handle this in the MLM's, rather than write a lot of TEC rules (dependency clauses and fact files), since this means that TEC has to get very busy in processing the flood....    ideas?  Other techniques?

thanks for any suggestions,

Don Mahler

ps On a related question, is there yet a rule writer for netview (windows), similar to what used to exist for netview/aix?
<Prev in Thread] Current Thread [Next in Thread>

Archive operated by Skills 1st Ltd

See also: The NetView Web