RE: [nv-l] [nv 7.1.4] Suppressing duplicate clogMessageGenerated traps prior to reaching TEC

[James Shanks <jshanks@us.ibm.com>]

I stand by what I said.  
Build a simple display ruleset first so you can debug it.

If it doesn't work there, then turn on nvcorrd debugging, nvcdebug -d all, and look in the nvcorrd.alog and.blog and watch what happens when you get the traps.


James Shanks
Level 3 Support  for Tivoli NetView for UNIX and Windows
Tivoli Software / IBM Software Group

"Van Order, Drew \(US - Hermitage\)" <dvanorder@deloitte.com> Sent by: owner-nv-l@lists.us.ibm.com 01/21/2004 09:42 AM Please respond to nv-l

To:        <nv-l@lists.us.ibm.com>         cc:                 Subject:        RE: [nv-l] [nv 7.1.4] Suppressing duplicate clogMessageGenerated traps prior to reaching TEC

Morning James,
 
I actually am trying to suppress these first at NV to give TEC a break. The event stream is set to block--I am trying to do this in TEC_ITS.rs. My explanation below apparently was confusing; I have a Trap Settings node (I called it an object) with only the clogMessageGenerated trap defined. It is the only trap within this Enterprise ID. I placed the Thresholds node between this Trap Setting and the Forward node. When it did not work there I tried putting the Threshold node between the Event Stream and Trap Settings node for grins. Based on what you are saying, I had it right the first time, but it does not work for some reason.
 
Drew
-----Original Message-----
From: owner-nv-l@lists.us.ibm.com [mailto:owner-nv-l@lists.us.ibm.com] On Behalf Of James Shanks
Sent: Wednesday, January 21, 2004 7:30 AM
To: nv-l@lists.us.ibm.com
Subject: Re: [nv-l] [nv 7.1.4] Suppressing duplicate clogMessageGenerated traps prior to reaching TEC


The first order of business is to stop trying to do this at TEC and start doing it in the Event Display. 
Only when you have it working there should you implement it as part of your TEC ruleset.  The Event Display and the TEC forwarding work exactly alike, so once you can see it, you know it will work. 

Second,  All rulesets start with the event stream node, the thing that looks like a purple pizza.  Open your ruleset in the ruleset editor, nvrsEdit, and click on the Event Stream.  Does it say BLOCK or PASS.  It must say BLOCK if your ruleset is going to filter events out. 

Third, what ruleset nodes precede your Threshold?  Trap Settings?  Event Attributes?  What?  How do you know you are thresholding on the right traps?

James Shanks
Level 3 Support  for Tivoli NetView for UNIX and Windows
Tivoli Software / IBM Software Group

"Van Order, Drew \(US - Hermitage\)" <dvanorder@deloitte.com> Sent by: owner-nv-l@lists.us.ibm.com 01/20/2004 07:50 PM Please respond to nv-l

To:        <nv-l@lists.us.ibm.com>        cc:                Subject:        [nv-l] [nv 7.1.4] Suppressing duplicate clogMessageGenerated traps prior to reaching TEC

Hi all,

I have searched the list archives and read the Admin guide--and must be doing something wrong. I am trying to implement a Thresholds rule to pass the first trap, then suppress the rest for 30 minutes. I want to suppress duplicates based on the enterprise ID and Origin (IP address). There is only one trap associated with this enterprise ID.

I take this as the settings should be:

Type is First
Count is 1
Time Period is 30
Attribute 1 is Origin

Cycle daemons--not working. Have also tried setting EnterpriseID as Attr 1 (even though it's default) and Origin as Attr 2. Have also tried setting the count to 2. I have put this object in between the Trap Settings and Forward objects, and have also put in between Event Stream and Trap Settings. I see numerous events at TEC. What am I doing wrong?

Thanks for helping a rook with a rook question!

Drew Van Order
ESM Architect
(615) 882-7836 Office
(888) 530-1012 Pager

This message (including any attachments) contains confidential information intended for a specific individual and purpose, and is protected by law. If you are not the intended recipient, you should delete this message. Any disclosure, copying, or distribution of this message, or the taking of any action based on it, is strictly prohibited.

This message (including any attachments) contains confidential information intended for a specific individual and purpose, and is protected by law. If you are not the intended recipient, you should delete this message. Any disclosure, copying, or distribution of this message, or the taking of any action based on it, is strictly prohibited.