Re: [nv-l] Using a MLM as a trap receiver

[Stephen Hochstetler <shochste@us.ibm.com>]

Assuming you have a multi-CPU box, I would recommend you install the MLM on your NetView server. You still get great benefits with this. You would need to change the port that trapd is listening to. You would configure the forwarding address of your MLM to the trapd listening port. You can configure trap filters in the MLM as rate rules or other duplicate detection. For example, if you receive more than 10 of these in 1 minute, only send the first 10 and drop the rest. (whatever rate rule you want). You can even do things that say to forward one event AFTER you have received 10 in 1 minute. A lot of power is there. It complements NetView nicely.

For the filtering done, there is very little CPU usage. When you get a storm, you can stop and start forwarding to NetView easily through the GUI or automated in scripts with SNMP commands. You could even set up an overall rate rule in MLM that recognizes storms and stops forwarding for a specific time period. I would recommend you setup something like that by vendor OID instead of for your whole network. This would allow some trap management to take place during a storm.

Another good reason to install the MLM on the NetView server is simply the fact that your devices are already forwarding to there.


Stephen Hochstetler shochste@us.ibm.com
International Technical Support Organization at IBM
Office - 512-838-6198 (t/l 678) FAX - 512-838-6931
http://www.redbooks.ibm.com
"Bursik, Scott {PBSG}" <Scott.Bursik@pbsg.com>

"Bursik, Scott {PBSG}" <Scott.Bursik@pbsg.com> Sent by: owner-nv-l@lists.us.ibm.com 02/11/2004 01:14 PM Please respond to nv-l

To: "Nv-L (nv-l@lists.us.ibm.com)" <nv-l@lists.us.ibm.com> cc: Subject: [nv-l] Using a MLM as a trap receiver

AIX 4.3.3 NetView 7.1.3

We are considering deploying a MLM to offload the incoming SNMP traps to. At
a high level are there any cons to doing this? Also, is there a way of doing
any duplicate detection at the MLM level in the case of an event storm?

Thanks,

Scott Bursik