nv-l
[Top] [All Lists]

Re: [nv-l] Has anyone implemented the full TEC integration (correlation

To: nv-l@lists.us.ibm.com
Subject: Re: [nv-l] Has anyone implemented the full TEC integration (correlation rules) NV 7.1.4 and TEC 3.9
From: Christopher Haynes <haynesch@us.ibm.com>
Date: Fri, 16 Jan 2004 15:44:20 -0500
Delivery-date: Fri, 16 Jan 2004 20:53:32 +0000
Envelope-to: nv-l-archive@lists.skills-1st.co.uk
In-reply-to: <400843D8.8020703@skills-1st.co.uk>
Reply-to: nv-l@lists.us.ibm.com
Sender: owner-nv-l@lists.us.ibm.com

In NV 7.1.4 state correlation does 2 things:
Appends fqhostname slot on events
Generates Service impacts events.

If you are not forwarding these events to a TEC 3.9 server then they will fail to parse because fqhostname slot is not defined in pre-3.9 netview.baroc file.
The recommended workaround of turning off state correlation should enable you to see 7.1.4 events on pre-3.9 TEC server.

Also note, I believe servmon is turned off by default.  If you turn on servmon the events he generates will also not show up in pre-3.9 servers as they are not defined in the netview.baroc file.

thanks,
Chris Haynes
haynesch@us.ibm.com
Tivoli Quality Assurance Manager
(919) 224-1217



Jane Curry <jane.curry@skills-1st.co.uk>
Sent by: owner-nv-l@lists.us.ibm.com

01/16/2004 03:04 PM
Please respond to nv-l

       
        To:        nv-l@lists.us.ibm.com
        cc:        
        Subject:        Re: [nv-l] Has anyone implemented the full TEC integration (correlation rules) NV 7.1.4 and TEC 3.9



I think that the only stuff that disabling state correlation affects is
if you are wanting to correlate service events from NetView with subnet
events from NetView.  Certainly I have some node/router/interface
up/down correlation going on.  I shall be doing more work on this week
so I'll keep you posted?

Cheers,
Jane

Van Order, Drew (US - Hermitage) wrote:

>Jane wins the prize--disabling state correlation now has events
>appearing in TEC...and the up's are HARMLESS, the downs/unreachable
>WARNING. Unfortunately, I'm not seeing the up or reachable again events
>closing the corresponding downs and unreachables. Does the state
>correlation option somehow enable the change rules in netview.rls?  
>
>-----Original Message-----
>From: owner-nv-l@lists.us.ibm.com [mailto:owner-nv-l@lists.us.ibm.com]
>On Behalf Of Jane Curry
>Sent: Friday, January 16, 2004 2:42 AM
>To: nv-l@lists.us.ibm.com
>Subject: Re: [nv-l] Has anyone implemented the full TEC integration
>(correlation rules) NV 7.1.4 and TEC 3.9
>
>
>Unless you have TEC 3.9 running then comment out the lines:
>UseStateCorrelation=YES
>StateCorrelationConfigURL=file:///usr/OV/conf/nvsbcrule.xml
>
>and run nvtecia -reload to pick up the modified config.  Even if you do
>have TEC 3.9, you might start by commenting these lines out to see if it
>
>is the State Correlation that is getting in the way.
>
>Cheers,
>Jane
>
>Van Order, Drew (US - Hermitage) wrote:
>
>  
>
>>I really screwed up guys--was looking at the 7.1 guide. The 7.1.4 UNIX
>>    
>>
>
>  
>
>>Guide has some decent information that gets you going in the right
>>direction. I ran the upgrade script and cycled the daemons.
>>Unfortunately, I see no events at TEC, nothing in wtdumprl, and
>>nothing in the /etc/Tivoli/tec cache files. I know TEC_ITS.rs exists
>>because I looked at it yesterday. Old tecint.conf:
>>
>>ServerLocation=dsmrdux02
>>TecRuleName=Trap2Tec.rs
>>ServerPort=0
>>
>>New tecint.conf:
>>
>>ServerLocation=dsmrdux02
>>TecRuleName=TEC_ITS.rs
>>ServerPort=0
>>DefaultEventClass=TEC_ITS_BASE
>>BufferEvents=YES
>>UseStateCorrelation=YES
>>StateCorrelationConfigURL=file:///usr/OV/conf/nvsbcrule.xml
>>## The following four lines are for debugging the state correlation
>>    
>>
>engine
>  
>
>># LogLevel=ALL
>># TraceLevel=ALL
>># LogFileName=/usr/OV/log/adptlog.out
>># TraceFileName=/usr/OV/log/adpttrc.out
>>
>>
>>TFNC events are coming through. Any suggestions? Thank you for your
>>patience--Drew
>>
>>    -----Original Message-----
>>    *From:* owner-nv-l@lists.us.ibm.com
>>    [mailto:owner-nv-l@lists.us.ibm.com] *On Behalf Of *James Shanks
>>    *Sent:* Thursday, January 15, 2004 2:39 PM
>>    *To:* nv-l@lists.us.ibm.com
>>    *Subject:* RE: [nv-l] Has anyone implemented the full TEC
>>    integration (correlation rules) NV 7.1.4 and TEC 3.9
>>
>>
>>    Drew -
>>
>>    The phrase "nvserverd.baroc" does not appear anywhere in the 7.1.4
>>    Admin Guide and the section Chris pointed to has revision bars on
>>    every page indicating that is new and changed material.  Are you
>>    certain that you are reading the 7.1.4 version?
>>
>>    James Shanks
>>    Level 3 Support  for Tivoli NetView for UNIX and Windows
>>    Tivoli Software / IBM Software Group
>>
>>
>>
>>                     *"Van Order, Drew \(US - Hermitage\)" <dvanorder@deloitte.com>*
>>    Sent by: owner-nv-l@lists.us.ibm.com
>>
>>    01/15/2004 02:59 PM
>>    Please respond to nv-l
>>
>>                            
>>            To:        <nv-l@lists.us.ibm.com>
>>            cc:        
>>            Subject:        RE: [nv-l] Has anyone implemented the full
>>    TEC integration (correlation rules) NV 7.1.4 and TEC 3.9
>>
>>
>>
>>
>>    Thank you. I read this yesterday, but it's older information,
>>    referencing nvserverd.baroc, when it's now netview.baroc. I guess
>>    that's my point; there are fragments of information in different
>>    documents. I only found the new files because I was pointed to the
>>    release notes! You have to piece it together as best you can and
>>    hope what you are reading is correct. I'm very grateful for you
>>    folks on the list. If this new correlation works, it is material
>>    for a chapter in a redbook or the next set of NV manauls.
>>    -----Original Message-----*
>>    From:* owner-nv-l@lists.us.ibm.com
>>    [mailto:owner-nv-l@lists.us.ibm.com] *On Behalf Of *Christopher
>>    Haynes*
>>    Sent:* Thursday, January 15, 2004 11:51 AM*
>>    To:* nv-l@lists.us.ibm.com*
>>    Subject:* RE: [nv-l] Has anyone implemented the full TEC
>>    integration (correlation rules) NV 7.1.4 and TEC 3.9
>>
>>
>>    Drew,
>>           Check out the stuff starting at the bottom of page 110 of
>>    teh NetView Administrator's Guide.
>>
>>
>>    
>>
>http://publib.boulder.ibm.com/tividd/td/netview/SC32-1246-00/en_US/PDF/d
>uyl2mst.pdf
>  
>
>>
>>
>>    thanks,
>>    Chris Haynes
>>    haynesch@us.ibm.com
>>    Tivoli Quality Assurance Manager
>>    (919) 224-1217
>>
>>
>>
>>                     *"Van Order, Drew \(US - Hermitage\)" <dvanorder@deloitte.com>*
>>    Sent by: owner-nv-l@lists.us.ibm.com
>>
>>    01/15/2004 12:32 PM
>>    Please respond to nv-l
>>
>>                            
>>           To:        <nv-l@lists.us.ibm.com>
>>           cc:        
>>           Subject:        RE: [nv-l] Has anyone implemented the full
>>    TEC integration (correlation rules) NV 7.1.4 and TEC 3.9
>>
>>
>>
>>
>>
>>    No doubt I overlooked something between the KB and manuals--where
>>    can I find this script? I did a find for TEC_* and tec_* no file
>>    resembling that name. If you can also point me to where this is
>>    documented, I would be grateful. Thanks James--Drew
>>    -----Original Message-----*
>>    From:* owner-nv-l@lists.us.ibm.com
>>    [mailto:owner-nv-l@lists.us.ibm.com] *On Behalf Of *James Shanks*
>>    Sent:* Thursday, January 15, 2004 11:01 AM*
>>    To:* nv-l@lists.us.ibm.com*
>>    Subject:* RE: [nv-l] Has anyone implemented the full TEC
>>    integration (correlation rules) NV 7.1.4 and TEC 3.9
>>
>>
>>    Drew -
>>
>>    I'm stumped about what is confusing to you.
>>    There is no configuration for you to do, other than run the
>>    tec_its_upgrade script and create a new tecint.conf (which happens
>>    nicely if you rename your old one and create a new one from
>>    serversetup).
>>
>>    The script changes the configuration of the NetView events in
>>    trapd.conf so that they work with the new TEC rules.  It makes
>>    TEC_ITS_BASE the new default event class instead of the old
>>    Nvserverd_Event  class.  And it removes severity as passed field,
>>    because severity will be set dynamically by the new TEC rules, and
>>    they cannot do that correctly if you are sending your choice of
>>    severity instead.  The NetView ruleset is the same one we shipped
>>    in NetView 7.1.3 :  TEC_ITS.rs.  Bring it up in the NetView
>>    ruleset editor and you'll see that it just picks out specific
>>    NetView events and sends them to TEC.  If you want additional
>>    events, from Cisco or something, you'll have to add those, but
>>    those lie outside of the new integration.
>>
>>    That's all there is to the NetView side.
>>
>>    James Shanks
>>    Level 3 Support  for Tivoli NetView for UNIX and Windows
>>    Tivoli Software / IBM Software Group
>>
>>                     *"Van Order, Drew \(US - Hermitage\)" <dvanorder@deloitte.com>*
>>    Sent by: owner-nv-l@lists.us.ibm.com
>>
>>    01/15/2004 11:24 AM
>>    Please respond to nv-l
>>
>>                            
>>          To:        <nv-l@lists.us.ibm.com>
>>          cc:        
>>          Subject:        RE: [nv-l] Has anyone implemented the full
>>    TEC integration (correlation rules) NV 7.1.4 and TEC 3.9
>>
>>
>>
>>
>>
>>
>>    I started on it last night, and it does have some very useful
>>    information. Unfortunately the NV side is where I am struggling
>>    the most; namely the trap configurations and NV forwarding
>>    ruleset. Until that is understood and confirmed configured
>>    correctly to match what TEC expects it's tough to tell how well
>>    the TEC rule is working. I just opened a sev 3 PMR; also offered
>>    to help write any documentation that could be considered a guide.
>>    Like most IT folks, I don't have the luxury of focusing on one
>>    project at a time, and really need to slam and jam when solutions
>>    are deemed shrink wrap.
>>
>>    Thanks for looking into this!
>>    -----Original Message-----*
>>    From:* owner-nv-l@lists.us.ibm.com
>>    [mailto:owner-nv-l@lists.us.ibm.com] *On Behalf Of *Christopher
>>    Haynes*
>>    Sent:* Thursday, January 15, 2004 9:57 AM*
>>    To:* nv-l@lists.us.ibm.com*
>>    Subject:* Re: [nv-l] Has anyone implemented the full TEC
>>    integration (correlation rules) NV 7.1.4 and TEC 3.9
>>
>>
>>    Drew,
>>         I don't know if you have looked at it yet but you might want
>>    to check out the TEC 3.9 Rule Set Reference
>>
>>
>>    
>>
>http://publib.boulder.ibm.com/tividd/td/tec/SC32-1282-00/en_US/PDF/ecosm
>st.pdf
>  
>
>>    It goes into detail about what all the rulesets do (including
>>    netview.rls)
>>
>>    thanks,
>>    Chris Haynes
>>    haynesch@us.ibm.com
>>    Tivoli Quality Assurance Manager
>>    (919) 224-1217
>>
>>                     *"Van Order, Drew \(US - Hermitage\)" <dvanorder@deloitte.com>*
>>    Sent by: owner-nv-l@lists.us.ibm.com
>>
>>    01/14/2004 08:09 PM
>>    Please respond to nv-l
>>
>>                            
>>         To:        <nv-l@lists.us.ibm.com>
>>         cc:        
>>         Subject:        [nv-l] Has anyone implemented the full TEC
>>    integration (correlation rules) NV 7.1.4 and TEC 3.9
>>
>>
>>
>>
>>
>>
>>
>>    If there is a single document, can someone point me to it? I've
>>    found pieces and parts in the different manuals, but it's not
>>    working out of box (as advertised by our sales team):
>>
>>        * Netview.baroc and netview.rls in rulebase
>>        * Netview6000 traps in NV ruleset TEC adapter uses
>>        * Netview6000 traps have TEC_ITS event classes mapped in
>>    
>>
>xnmtrap
>  
>
>>          Events reach TEC, but severities do not make sense, and I'm
>>          sure this means any change rules in the ruleset will not
>>          execute. For example, TEC_ITS_INTERFACE_STATUS is HARMLESS
>>          at TEC, yet message is interface xxx is down. However, I
>>          have a SEGMENT_STATUS and NETWORK_STATUS event as WARNING in
>>          TEC, but the message indicates they are up. The netview6000
>>          traps are set from previous versions where TEC classes were
>>          OV_. I directly edited TEC classes for each trap in xnmtrap,
>>          but I think this issue pertains to TEC slots that are not
>>          being passed in the trap or matching what the TEC rule
>>    
>>
>expects.
>  
>
>>          We are trying to replace TFNC, which has been worth every
>>          penny. Do I need to feed the netview6000 MIB through
>>          mib2trap again--and will this populate xnmtrap properly?
>>          What's the name of the mibfile that contains the netview6000
>>          OID?
>>
>>          Sorry for all the questions--since this integration crosses
>>          NV and TEC boundaries, I'm not sure if a PMR will get me
>>          anywhere. I think I'm getting close, but there has to be an
>>          easier way.
>>
>>          Thanks--Drew
>>
>>          */Drew Van Order/* */
>>          ESM Architect/* */
>>          (615) 882-7836 Office/* */
>>          (888) 530-1012 Pager/*
>>
>>          This message (including any attachments) contains
>>          confidential information intended for a specific individual
>>          and purpose, and is protected by law. If you are not the
>>          intended recipient, you should delete this message. Any
>>          disclosure, copying, or distribution of this message, or the
>>          taking of any action based on it, is strictly prohibited.
>>
>>          This message (including any attachments) contains
>>          confidential information intended for a specific individual
>>          and purpose, and is protected by law. If you are not the
>>          intended recipient, you should delete this message. Any
>>          disclosure, copying, or distribution of this message, or the
>>          taking of any action based on it, is strictly prohibited.
>>
>>          This message (including any attachments) contains
>>          confidential information intended for a specific individual
>>          and purpose, and is protected by law. If you are not the
>>          intended recipient, you should delete this message. Any
>>          disclosure, copying, or distribution of this message, or the
>>          taking of any action based on it, is strictly prohibited.
>>
>>          This message (including any attachments) contains
>>          confidential information intended for a specific individual
>>          and purpose, and is protected by law. If you are not the
>>          intended recipient, you should delete this message. Any
>>          disclosure, copying, or distribution of this message, or the
>>          taking of any action based on it, is strictly prohibited.
>>
>>
>>This message (including any attachments) contains confidential
>>information intended for a specific individual and purpose, and is
>>protected by law. If you are not the intended recipient, you should
>>delete this message. Any disclosure, copying, or distribution of this
>>message, or the taking of any action based on it, is strictly
>>    
>>
>prohibited.
>  
>
>
>  
>

--
Tivoli Certified Consultant & Instructor
Skills 1st Limited, 2 Cedar Chase, Taplow, Bucks, SL6 0EU, UK
Tel: +44 (0)1628 782565
Copyright (c) 2004 Jane Curry <jane.curry@skills-1st.co.uk>.  All rights reserved.



<Prev in Thread] Current Thread [Next in Thread>

Archive operated by Skills 1st Ltd

See also: The NetView Web