Re: [nv-l] ruleset problem - action

[James Shanks <jshanks@us.ibm.com>]

The NetView for Windows program is not
interchangeable with the NetView for UNIX program.  While they share
perhaps 70 per cent of the same code, they are not and cannot be identical
due to platform differences.  Code cannot simply be ported from one
OS to another as it is between the various flavors of UNIX, so some things
are only partially implemented.  One area where they are radically
different is in the area of events.  Some differences are obvious.
 Others are not.

Rulesets can be run on Windows only
in a very limited fashion.  They were primarily implemented there
as custom filters for the Event Browser.

There is no actionsvr process on NetView
for Windows, so there is no one to hand the actions off too.  Thus
ruleset action nodes, including the pager node, are not supported on Windows.
 If you want an action on Windows it must be an in-line action.  
 Other things that are not supported are Block, Resolve, and currently,
Override status and severity (there is an open APAR about the last one
causing serious problems on your machine should you try to run the sample
setstatusandseverity.rs).  Since trapd stores events directly in the
ODBC database, and the Event Browser reads them directly from the database,
there is no way for nvcord to influence the ones already stored.  For
his other operations, he creates a new event out of the old one and sends
that back to trapd to be stored, thus creating a near-duplicate event for
every event correlated.  

In-line actions do work.  I have
done many.  But I suggest that you start small, like echoing varbind
information to a file, so you can see what is being passed to your script
before trying anything more difficult.  All varbinds are sanitized
on both UNIX and Windows to prevent a command like echo from hosing your
system should a bogus trap be sent to your systems with a hidden command
in it.  That is why you should start by echoing what you have to file,
so you can see what you need to do it.  There are also things you
cannot do from an in-line action on Windows, because Windows does not allow
a background process such as nvcord to have access to the display console.
 So nvecho will not work.  But nvmail should, provided you have
a mail server (probably your Linux box) to send them to. 

Personally, I think you would be much
better off with Linux, if event correlation via rulesets is your goal.
 If you want Windows, then you must accept its limitations.  If
you want to do things like nvecho then you must do then directly from Trap
Settings and specify that your script is a console application.  The
trapd daemon will package it and send it to polling, which is a process
started by the NetView GUI on Windows.  Only a GUI app has access
to the display so the NetView GUI must be up, and the polling process active,
for your console command to work.  

All of the things you mention I have
seen work from Trap Settings.

James Shanks
Level 3 Support  for Tivoli NetView for UNIX and Windows
Tivoli Software / IBM Software Group

lucian.vanghele@bisnet.ro
Sent by: owner-nv-l@lists.us.ibm.com

03/11/2004 08:14 AM

Please respond to
nv-l

To	nv-l@lists.us.ibm.com
cc
Subject	[nv-l] ruleset problem - action

hi there list!
I have a problem trying to use a rule created on a linux machine and
imported on my Windows Netview server. Mainly it does a pass on match and
after that I try to do an action or an inline action. For an action I have
"Off-line actions for Event Correlation are disabled for this release"
and
for the inline action I have: Varbind contained an illegal character.
issuing sanitized version of the varbind:". I tried in both cases
actions
like: "net send Administrator mesage", copy a file, nvecho and
still no
results.
any clue?
thanks
Lucian Vanghele