Re: [nv-l] Ruleset editor for Windows?

[James Shanks <jshanks@us.ibm.com>]

There is no ruleset editor for Windows and there is not likely to be one, because the usefulness of ruleset on Windows is nothing like what it is on UNIX.

There is no actionsvr, no way to remove events from the event display, and some ruleset nodes like the pager and the (off-line) action node, do not work at all on Windows.  These limitations can be overcome, if you are clever and dedicated, but even then, the results may not be what you expect.

Yes, NetView Linux does have a ruleset editor.  But even after you port your UNIX rule to Windows, it may have to be modified in order to work correctly.
There are some guidelines in the Windows Programmer's Guide,  concerning how to edit an rs file, but it is not much.  Just be sure to use WordPad, and not NotePad, or you will corrupt the file and nvcord will fail trying to load it.

So you must be very, very careful about what you are trying to accomplish with rulesets on Windows.   The original design saw them only as providing additional filtering capabilities for the Event Browser, which is why the samples are so lame,  but beyond that the implementation leaves a lot to be desired.  To understand why, remember that on Windows, all events are stored directly in the ODBC database by trapd.  And the Event Browser reads events from the ODBC database.  There is no event flow on Windows like there is on UNIX with nvcorrd in the middle.  So every thing that nvcord (notice the spelling difference on Windows) does with an event on Windows is after the fact.  This results in some rather strange design issues.

First, every successful ruleset on Windows will create a new, near duplicate event of the original event and store this near duplicate back in the ODBC database.  That's because the original one is already in there and cannot be modified.  So when you use the "ALL Events" filter instead of the ruleset custom filter, you will see both the original event and the duplicates too.  This may seem very confusing and most people don't care for it.  When you use the ruleset as a custom filter, you will see only the events which it created.  

Second, each near duplicate event gets a new first varbind inserted, an integer which tells the Event Browser what ruleset was used to create the near duplicate.  That's how the Event Browser knows which ones to display for each ruleset.   But because there is a new first varbind, all the original varbinds are "pushed down" one position; old varbind one becomes new varbind two, varbind two becomes three, and so on, which can mess up how the event is displayed, depending on how it is formatted in trapd.conf.  As I said, the implementation leaves a lot to be desired.   But that's how it works.  For simple cases, it is reliable enough, but not very useful in my opinion.

However, there are two open APARs on this function as I write this.  One is for the fact that the agent address is corrupted in the near duplicate events.  No matter what agent sent them, the new event has the NetView box itself as the agent.  And the other is that a ruleset which wishes to override the status or severity of an event, such as the setstatusseverity.rs which ships with the product, will cause severe problems because that function is broken.     Eventually both of these problems will be fixed, but they are not now.  

Thus, as a general rule, rulesets on Windows should be avoided, except in special circumstances.
Just what did you want to do with them?

James Shanks
Level 3 Support  for Tivoli NetView for UNIX and Windows
Tivoli Software / IBM Software Group

CMazon@commercebankfl.com Sent by: owner-nv-l@lists.us.ibm.com 12/19/2003 03:52 PM Please respond to nv-l

To:        nv-l@lists.us.ibm.com         cc:                 Subject:        [nv-l] Ruleset editor for Windows?

Netview 7.1.4 Windows 2000 

Is there a guide to manually write a ruleset for windows? I know there is no rule set editor for windows and we do not have the resources to set up a Unix flavor of the product.  I would like to understand the variables in the file and how they are set in the file itself so that I may be able to create some simple rulesets for our needs. 


Is the ruleset editor available in Netview for Linux, I may be able to run a virtual PC with Linux and set that up just for that purpose. 

Thanks. 

Carlos.