RE: [nv-l] $A Attribute

[James Shanks <jshanks@us.ibm.com>]

Sorry, but I understand none of what
you are doing.  It sounds to me as if you should leave the origin
alone and add a new field to the event sent to TEC,
because the short answer to your question,
as I understand it, is "no".

The original trap has an IP address
coded in it.  That's what gets decoded as $A.   Nothing else.
 

You can see this if you get a trapd.trace
while trapd is running with the -x option (hex dump all packets).
The origin address will be the field
which begins " x'40  04  xx  xx  xx  xx "
 where the "xx" represent the hex bytes of the IP address.
 It's the field that follows the enterprise OID of the trap.

So I see only three alternatives.
(1) you either have to override what's
in DNS with a local /etc/hosts file (and the details for that differ with
your OS. so I'll leave that to you), or
(2)  to issue your own trap with
the preferred origin. or a new field,  in it and send that to TEC
instead of the original, or  
(3) send your own TEC event with postemsg
and the normalized hostname you want.

Option 1 will also affect how your trap
displays in NetView.  Option 2 is done either by a ruleset run in
ESE.automation or a script launched by ovactiond.
Option 3 is usually done by a ruleset
in ESE.automation or in the TEC ruleset. 

Otherwise, you have to do your normalization
in the TEC rules instead.  I'm confused about your complicated NetView
process because, although I am not a TEC rules specialist,  it seems
to me  that you could code your TEC rule to fire on either the FQDN
or the shortname, and as long as NetView is the source of the event, it's
going to decode the hostname the same way every time unless you change
the name resolution.  

 I suspect that what you really
have in mind is some kind of group membership, like belonging to a smartset,
and to pass that along you typically want a new field in the event.


James Shanks
Level 3 Support  for Tivoli NetView for UNIX and Windows
Tivoli Software / IBM Software Group

"Bursik, Scott {PBSG}" <Scott.Bursik@pbsg.com>
Sent by: owner-nv-l@lists.us.ibm.com

05/10/2004 02:02 PM

Please respond to
nv-l

To	"'nv-l@lists.us.ibm.com'" <nv-l@lists.us.ibm.com>
cc
Subject	RE: [nv-l] $A Attribute

I found this in the documentation:
 
$A Display the trap agent-addr
using gethostbyaddr as a string…………
 
Is there a set variable for
the address before gethostbyaddr is used? I know that some vendors supply
the host address as one of the trap variables, but I am looking to send
some of my traps to a more generic way of process events, and not on a
per event level.
 
Example:
 
I have traps from several vendors
that will send $A, $G, $S, $e and $* to a script that does some more processing
before sending to TEC. This way all of my traps are set to do the same
thing. I need the IP address for each node so I can run them through a
name normalization process that we have that takes the Tivoli Endpoint
name if available and assigns that to the host name field for event correlation
in TEC. This name normalization process is keyed off of the IP address.
 
Hope this makes sense.
 
 
Scott Bursik
Enterprise Systems Management
PepsiCo Business Solutions Group
(972) 963-1400
scott.bursik@pbsg.com

---

From: James Shanks [mailto:jshanks@us.ibm.com]
Sent: Monday, May 10, 2004 11:58 AM
To: nv-l@lists.us.ibm.com
Subject: Re: [nv-l] $A Attribute
 

For the origin IP address included in all SNMP V1 traps.  It's a required
field per the RFCs. 

James Shanks
Level 3 Support  for Tivoli NetView for UNIX and Windows
Tivoli Software / IBM Software Group

"Bursik, Scott {PBSG}" <Scott.Bursik@pbsg.com>
Sent by: owner-nv-l@lists.us.ibm.com

05/10/2004 12:42 PM

Please respond to
nv-l

To	"Nv-L (nv-l@lists.us.ibm.com)" <nv-l@lists.us.ibm.com>
cc
Subject	[nv-l] $A Attribute

 

AIX 4.3.3 NetView 7.1.3

How is the $A attribute derived for trap attributes?

Thanks,

Scott Bursik