|
Thanks a lot James!
first of all: our client want Windows so it's not my decision!
secondly, I already tried a small rule with just an event attribute and an inline action: set > log.log and it worked ok!! now I'll start with a script to see what's next
thanks again for the explanations!
Lucian
The NetView for Windows program is not interchangeable with the NetView for UNIX program. While they share perhaps 70 per cent of the same code, they are not and cannot be identical due to platform differences. Code cannot simply be ported from one OS to another as it is between the various flavors of UNIX, so some things are only partially implemented. One area where they are radically different is in the area of events. Some differences are obvious. Others are not.
Rulesets can be run on Windows only in a very limited fashion. They were primarily implemented there as custom filters for the Event Browser.
There is no actionsvr process on NetView for Windows, so there is no one to hand the actions off too. Thus ruleset action nodes, including the pager node, are not supported on Windows. If you want an action on Windows it must be an in-line action. Other things that are not supported are Block, Resolve, and currently, Override status and severity (there is an open APAR about the last one causing serious problems on your machine should you try to run the sample setstatusandseverity.rs). Since trapd stores events directly in the ODBC database, and the Event Browser reads them directly from the database, there is no way for nvcord to influence the ones already stored. For his other operations, he creates a new event out of the old one and sends that back to trapd to be stored, thus creating a near-duplicate event for every event correlated.
In-line actions do work. I have done many. But I suggest that you start small, like echoing varbind information to a file, so you can see what is being passed to your script before trying anything more difficult. All varbinds are sanitized on both UNIX and Windows to prevent a command like echo from hosing your system should a bogus trap be sent to your systems with a hidden command in it. That is why you should start by echoing what you have to file, so you can see what you need to do it. There are also things you cannot do from an in-line action on Windows, because Windows does not allow a background process such as nvcord to have access to the display console. So nvecho will not work. But nvmail should, provided you have a mail server (probably your Linux box) to send them to.
Personally, I think you would be much better off with Linux, if event correlation via rulesets is your goal. If you want Windows, then you must accept its limitations. If you want to do things like nvecho then you must do then directly from Trap Settings and specify that your script is a console application. The trapd daemon will package it and send it to polling, which is a process started by the NetView GUI on Windows. Only a GUI app has access to the display so the NetView GUI must be up, and the polling process active, for your console command to work.
All of the things you mention I have seen work from Trap Settings.
James Shanks
Level 3 Support for Tivoli NetView for UNIX and Windows
Tivoli Software / IBM Software Group
lucian.vanghele@bisnet.ro
Sent by: owner-nv-l@lists.us.ibm.com
03/11/2004 08:14 AM
|
|
To |
|
|
cc |
![]() |
|
Subject |
[nv-l] ruleset problem - action |
| hi there list!
I have a problem trying to use a rule created on a linux machine and
imported on my Windows Netview server. Mainly it does a pass on match and
after that I try to do an action or an inline action. For an action I have
"Off-line actions for Event Correlation are disabled for this release" and
for the inline action I have: Varbind contained an illegal character.
issuing sanitized version of the varbind:". I tried in both cases actions
like: "net send Administrator mesage", copy a file, nvecho and still no
results.
any clue?
thanks
Lucian Vanghele
|