nv-l
[Top] [All Lists]

Re: [nv-l] Using a MLM as a trap receiver

To: nv-l@lists.us.ibm.com
Subject: Re: [nv-l] Using a MLM as a trap receiver
From: Stephen Hochstetler <shochste@us.ibm.com>
Date: Wed, 11 Feb 2004 13:27:10 -0600
Delivery-date: Wed, 11 Feb 2004 19:33:02 +0000
Envelope-to: nv-l-archive@lists.skills-1st.co.uk
In-reply-to: <42AF0749A8EB7448A661EC423CBE76FA05FD20@pbswmu00003.corp.pep.pvt>
Reply-to: nv-l@lists.us.ibm.com
Sender: owner-nv-l@lists.us.ibm.com

Assuming you have a multi-CPU box, I would recommend you install the MLM on your NetView server. You still get great benefits with this. You would need to change the port that trapd is listening to. You would configure the forwarding address of your MLM to the trapd listening port. You can configure trap filters in the MLM as rate rules or other duplicate detection. For example, if you receive more than 10 of these in 1 minute, only send the first 10 and drop the rest. (whatever rate rule you want). You can even do things that say to forward one event AFTER you have received 10 in 1 minute. A lot of power is there. It complements NetView nicely.

For the filtering done, there is very little CPU usage. When you get a storm, you can stop and start forwarding to NetView easily through the GUI or automated in scripts with SNMP commands. You could even set up an overall rate rule in MLM that recognizes storms and stops forwarding for a specific time period. I would recommend you setup something like that by vendor OID instead of for your whole network. This would allow some trap management to take place during a storm.

Another good reason to install the MLM on the NetView server is simply the fact that your devices are already forwarding to there.


Stephen Hochstetler shochste@us.ibm.com
International Technical Support Organization at IBM
Office - 512-838-6198 (t/l 678) FAX - 512-838-6931
http://www.redbooks.ibm.com
Inactive hide details for "Bursik, Scott {PBSG}" <Scott.Bursik@pbsg.com>"Bursik, Scott {PBSG}" <Scott.Bursik@pbsg.com>




          "Bursik, Scott {PBSG}" <Scott.Bursik@pbsg.com>
          Sent by: owner-nv-l@lists.us.ibm.com

          02/11/2004 01:14 PM
          Please respond to nv-l



To: "Nv-L (nv-l@lists.us.ibm.com)" <nv-l@lists.us.ibm.com>
cc:
Subject: [nv-l] Using a MLM as a trap receiver


AIX 4.3.3 NetView 7.1.3

We are considering deploying a MLM to offload the incoming SNMP traps to. At
a high level are there any cons to doing this? Also, is there a way of doing
any duplicate detection at the MLM level in the case of an event storm?

Thanks,

Scott Bursik

 
 
 



GIF image

<Prev in Thread] Current Thread [Next in Thread>

Archive operated by Skills 1st Ltd

See also: The NetView Web