You are talking about TEC and its event classes. TEC is designed to only
accept events that it has been informed about. This is both for the
"class" of event as well as the "slots" hold information in that event.
You can read about this in the TEC manuals on the www.ibm.com\tivoli web
site. Go into "Library", then "Product manuals". The information is
documented in BAROC files for the TEC server.
TEC 3.8 and beyond by default has the BAROC file for NetView events. When
you first tried to send your event to NetView, you probably saw an
"unformated trap" error message. Once you configured trap settings with
your enterprise and trap number, it was now recognized as a formatted trap.
For TEC it is very similar.
Usually, every trap that has a unique trap number in an Enterprise gets
mapped to a specific TEC class. You can write correlation rules in TEC
based on the TEC class and slot values. While NetView will put out an
unformated trap message, TEC simply throws away events that have not been
put into his BAROC files.
Every GOOD SNMP vendor does document their traps. Not every vendor does
this, but the world is not perfect. If you are on UNIX you can set the
CLASS the same place you defined the trap settings. In Windows you do it
in the CDS file. You still need to create a BAROC file and get it loaded
into TEC. Look at the NetView.baroc for an example.
------------ start soapbox
Really it comes down to this:
Only send events to TEC if you need to correlate them, take automated
action or notify an operator. Otherwise, stop them where you can to save
processing and network usage.
-------------
For a customer that says they want to get to a handful of TEC classes...it
just depends. If they looked at the potential problems they are
handling, can they classify them into just a handful of event types. You
should only create classes if it helps you correlate or notify someone.
------------- end soapbox
Steve
Stephen Hochstetler shochste@us.ibm.com
International Technical Support Organization at IBM
Office - 512-838-6198 (t/l 678) FAX - 512-838-6931
http://www.redbooks.ibm.com
Girish Mantry
<gmantry@arcsight To:
"'nv-l@lists.tivoli.com'"
.com> <nv-l@lists.tivoli.com>
cc:
09/09/2003 04:18 Subject: [nv-l] what is tivoli
class definition?
PM
Hi,
I got a Tivoli Netview 7.1.3. One of our customers has the following
requirement about tivoli class definitions. The documentation on netview
does not seem to have anything about tivoli class definitions. Could you
help me understand what he is talking about?
Thanks a bunch
Girish
Customer States:
Vendors that boast the use of SNMP to send alerts into Tivoli must describe
how events are to be mapped into Tivoli. The standard Tivoli SNMP interface
does not have a MIB compiler and needs a "class definition" for each type
of
message that will be sent and translated into Tivoli. Many vendors do not
document their SNMP traps. MIBs are not always useful and may not compile
under Openview or Netview either. Logfiles have another set of problems. If
messages cannot be easily translated into a handful of Tivoli class
definitions we are unlikely to find the product friendly or acceptable.
---------------------------------------------------------------------
To unsubscribe, e-mail: nv-l-unsubscribe@lists.tivoli.com
For additional commands, e-mail: nv-l-help@lists.tivoli.com
*NOTE*
This is not an Offical Tivoli Support forum. If you need immediate
assistance from Tivoli please call the IBM Tivoli Software Group
help line at 1-800-TIVOLI8(848-6548)
---------------------------------------------------------------------
To unsubscribe, e-mail: nv-l-unsubscribe@lists.tivoli.com
For additional commands, e-mail: nv-l-help@lists.tivoli.com
*NOTE*
This is not an Offical Tivoli Support forum. If you need immediate
assistance from Tivoli please call the IBM Tivoli Software Group
help line at 1-800-TIVOLI8(848-6548)
|