Re: [nv-l] MLM events in TEC - state correlation

[wolfgang.bergbauer@attglobal.net]

Hi James,

Thanks for the info. I was already searching
for documentation like crazy for this state correlation in Netview and
just assumed that the TEC 3.9 rule builder guide is the one.
and:
> Besides, how did we go from problems
with a  6.0.3 migration, with MLM event parsing failures, to writing
your own stuff for the State Correlation engine? 
well isn´t that the normal event flow?
;-)

In regards to the tec netview rule,
I did lots of testing and it looks really good. I have not profiled the
rule yet, but it is quite big and definitely takes some processor cycles.
So since in our environment about 80% of all Node/Network/Router problems
are resolved within 5 minutes, it makes sense to just get rid of these
events at the source. I will use my favorite tool for correlation :-),
no fancy stuff just a reset on match to give the network 5 minutes to recover.

Thanks again for your help,

        Wolfgang

------------------------------------------------------------------
Wolfgang Bergbauer
Network and System Management Consultant
Cell phone: +49 172 534 9131
E-mail: wolfgang.bergbauer@attglobal.net

James Shanks <jshanks@us.ibm.com>
Sent by: owner-nv-l@lists.us.ibm.com

05.08.2004 22:45

Please respond to
nv-l@lists.us.ibm.com

To	nv-l@lists.us.ibm.com
cc
Subject	Re: [nv-l] MLM events in TEC - state correlation

I would not know what to tell you. 
We do not recommend any user modifications to the xml rules file for state
correlation. 
That's why there is no documentation on how to use them for your own purposes.
 If you change them or add to them, then you are quite literally on
your own.  And there are no plans for the xml rule files to replace
nvcorrd rulesets. 

I am sorry to tell you this, but the ruleset editor remains the one and
only supported method of deciding what goes to TEC in NetView for UNIX,
whether you are happy with it or not. 

And the current direction is not to do so much correlation in NetView anyway,
but rather to do it in TEC.  NetView is now a part of TEC and the
TEC guys have provided an entirely new set of rules there to correlate
events for you.  If you are trying to correlate events like Interface_Up/Interface_Down/Node_Up/Node_Marginal/Node_Down/Router_Down/Router_Marginal/Router_Up,
that's exactly what the new TEC rules do right out of the box.  Those
that match will close the others, and those that remain open increase in
severity over time. 

Besides, how did we go from problems with a  6.0.3 migration, with
MLM event parsing failures, to writing your own stuff for the State Correlation
engine? 
This is a completely new topic, isn't it? 

James Shanks
Level 3 Support  for Tivoli NetView for UNIX and Windows
Tivoli Software / IBM Software Group

wolfgang.bergbauer@attglobal.net
Sent by: owner-nv-l@lists.us.ibm.com

08/05/2004 03:48 PM

Please respond to
nv-l

To	nv-l@lists.us.ibm.com
cc
Subject	Re: [nv-l] MLM events in TEC - state correlation

Hi James, 

I had a parsing error in state correlation engine, I think it was a problem
with the formatting of the trap when using snmptrap. Trapd processed the
event without issues, but the state correlation engine did not, so it never
made it to TEC. 
Now one question in regards to the State Correlation. I spend almost the
whole day getting a simple reset on match rule to work, without success.
Does anybody know if the function defined within the default rules, just
stop further rule processing for TEC_ITS_NODE_STATUS events.
The idea I had was to use the state correlation for delaying Node Status
and Router status events for 5 minutes. In the past we used the Ruleset
editor, which I really hate because we have quite a big ruleset and it
is a nightmare to maintain this rule. (You have to docment seperately what
is under the icons). 

Thanks for your information and kind regards, 

       Wolfgang 


------------------------------------------------------------------
Wolfgang Bergbauer
Network and System Management Consultant
Cell phone: +49 172 534 9131
E-mail: wolfgang.bergbauer@attglobal.net

James Shanks <jshanks@us.ibm.com>
Sent by: owner-nv-l@lists.us.ibm.com

04.08.2004 20:39

Please respond to
nv-l@lists.us.ibm.com

To	nv-l@lists.us.ibm.com
cc
Subject	Re: [nv-l] MLM events in TEC

All events sent by nvserverd go as TEC_ITS_BASE unless you define another
default event class in tecint.conf or specifically define an event class
in trapd.conf.  TEC_ITSBASE replaces the old Nvseverd_Event class
as the default class.  By the way, the only way you would see events
you don't expect over in TEC is if you were using some ruleset other than
TEC_ITS.rs or if you modified it.   

trapd.conf entries ignored?  You'd have to prove that to me.  Having
worked on this code for 7 years, I'm willing to bet that's not true.
So what are you expecting that you don't see?   


James Shanks
Level 3 Support  for Tivoli NetView for UNIX and Windows
Tivoli Software / IBM Software Group

wolfgang.bergbauer@attglobal.net
Sent by: owner-nv-l@lists.us.ibm.com

08/04/2004 02:09 PM

Please respond to
nv-l

To	nv-l@lists.us.ibm.com
cc
Subject	[nv-l] MLM events in TEC

Hi all, 

After migrating Netview 6.0.3 to Netview 7.1.4 FP01 we see problems with
our MLM events. 
All the MLM events are coming into TEC as TEC_ITS_BASE, with some variables
that identify it as MLM/Threshold events, with a generic and specific trapd
ID 

Now 2 issues here: 

1. When I look into trapd.conf, there is no TEC Event defined for MLM/Threshold
events. How can it go to TEC then as TEC_ITS_BASE.
2. For all our  MLM ARM/ReARM events I have specific entries in the
trapd.conf with OID of Tivoli/MLM_Threshold {1.3.6.1.4.1.2.6.12.5.1} and
a unique specific trap ID. 
This definition seems to be completely ignored. 

Thanks for your help. 

Kind regards, 

     Wolfgang 
------------------------------------------------------------------
Wolfgang Bergbauer
Network and System Management Consultant
Cell phone: +49 172 534 9131
E-mail: wolfgang.bergbauer@attglobal.net