Thanks for the information Stephen!
Right now our clients send the SNMP traps to a DNS alias so migrating the
traps to a MLM is a no brainer. Are there any other advantages to running
the MLM on the NetView server vs. another machine? I would rather offload
that processing so my NV server doesn't have to breathe as hard.
Thanks,
Scott Bursik
Enterprise Systems Management
PepsiCo Business Solutions Group
(972) 963-1400
scott.bursik@pbsg.com
________________________________________
From: Stephen Hochstetler [mailto:shochste@us.ibm.com]
Sent: Wednesday, February 11, 2004 1:27 PM
To: nv-l@lists.us.ibm.com
Subject: Re: [nv-l] Using a MLM as a trap receiver
Assuming you have a multi-CPU box, I would recommend you install the MLM on
your NetView server. You still get great benefits with this. You would need
to change the port that trapd is listening to. You would configure the
forwarding address of your MLM to the trapd listening port. You can
configure trap filters in the MLM as rate rules or other duplicate
detection. For example, if you receive more than 10 of these in 1 minute,
only send the first 10 and drop the rest. (whatever rate rule you want). You
can even do things that say to forward one event AFTER you have received 10
in 1 minute. A lot of power is there. It complements NetView nicely.
For the filtering done, there is very little CPU usage. When you get a
storm, you can stop and start forwarding to NetView easily through the GUI
or automated in scripts with SNMP commands. You could even set up an overall
rate rule in MLM that recognizes storms and stops forwarding for a specific
time period. I would recommend you setup something like that by vendor OID
instead of for your whole network. This would allow some trap management to
take place during a storm.
Another good reason to install the MLM on the NetView server is simply the
fact that your devices are already forwarding to there.
Stephen Hochstetler shochste@us.ibm.com
International Technical Support Organization at IBM
Office - 512-838-6198 (t/l 678) FAX - 512-838-6931
http://www.redbooks.ibm.com
"Bursik, Scott {PBSG}" <Scott.Bursik@pbsg.com>
"Bursik, Scott {PBSG}" <Scott.Bursik@pbsg.com>
Sent by: owner-nv-l@lists.us.ibm.com
02/11/2004 01:14 PM
Please respond to nv-l
To: "Nv-L (nv-l@lists.us.ibm.com)" <nv-l@lists.us.ibm.com>
cc:
Subject: [nv-l] Using a MLM as a trap receiver
AIX 4.3.3 NetView 7.1.3
We are considering deploying a MLM to offload the incoming SNMP traps to. At
a high level are there any cons to doing this? Also, is there a way of doing
any duplicate detection at the MLM level in the case of an event storm?
Thanks,
Scott Bursik
|