| To: | nv-l@lists.us.ibm.com |
|---|---|
| Subject: | Re: [nv-l] MLM events in TEC - state correlation |
| From: | James Shanks <jshanks@us.ibm.com> |
| Date: | Thu, 5 Aug 2004 17:27:19 -0400 |
| Delivery-date: | Thu, 05 Aug 2004 22:42:47 +0100 |
| Envelope-to: | nv-l-archive@lists.skills-1st.co.uk |
| In-reply-to: | <OF622ADF21.CDB272AB-ONC1256EE7.0073A087-C1256EE7.0074B8FF@attglobal.net> |
| Reply-to: | nv-l@lists.us.ibm.com |
| Sender: | owner-nv-l@lists.us.ibm.com |
|
You are quite welcome. Good luck. James Shanks Level 3 Support for Tivoli NetView for UNIX and Windows Tivoli Software / IBM Software Group
Hi James, Thanks for the info. I was already searching for documentation like crazy for this state correlation in Netview and just assumed that the TEC 3.9 rule builder guide is the one. and: > Besides, how did we go from problems with a 6.0.3 migration, with MLM event parsing failures, to writing your own stuff for the State Correlation engine? well isn´t that the normal event flow? ;-) In regards to the tec netview rule, I did lots of testing and it looks really good. I have not profiled the rule yet, but it is quite big and definitely takes some processor cycles. So since in our environment about 80% of all Node/Network/Router problems are resolved within 5 minutes, it makes sense to just get rid of these events at the source. I will use my favorite tool for correlation :-), no fancy stuff just a reset on match to give the network 5 minutes to recover. Thanks again for your help, Wolfgang ------------------------------------------------------------------ Wolfgang Bergbauer Network and System Management Consultant Cell phone: +49 172 534 9131 E-mail: wolfgang.bergbauer@attglobal.net
I would not know what to tell you. We do not recommend any user modifications to the xml rules file for state correlation. That's why there is no documentation on how to use them for your own purposes. If you change them or add to them, then you are quite literally on your own. And there are no plans for the xml rule files to replace nvcorrd rulesets. I am sorry to tell you this, but the ruleset editor remains the one and only supported method of deciding what goes to TEC in NetView for UNIX, whether you are happy with it or not. And the current direction is not to do so much correlation in NetView anyway, but rather to do it in TEC. NetView is now a part of TEC and the TEC guys have provided an entirely new set of rules there to correlate events for you. If you are trying to correlate events like Interface_Up/Interface_Down/Node_Up/Node_Marginal/Node_Down/Router_Down/Router_Marginal/Router_Up, that's exactly what the new TEC rules do right out of the box. Those that match will close the others, and those that remain open increase in severity over time. Besides, how did we go from problems with a 6.0.3 migration, with MLM event parsing failures, to writing your own stuff for the State Correlation engine? This is a completely new topic, isn't it? James Shanks Level 3 Support for Tivoli NetView for UNIX and Windows Tivoli Software / IBM Software Group
Hi James, I had a parsing error in state correlation engine, I think it was a problem with the formatting of the trap when using snmptrap. Trapd processed the event without issues, but the state correlation engine did not, so it never made it to TEC. Now one question in regards to the State Correlation. I spend almost the whole day getting a simple reset on match rule to work, without success. Does anybody know if the function defined within the default rules, just stop further rule processing for TEC_ITS_NODE_STATUS events. The idea I had was to use the state correlation for delaying Node Status and Router status events for 5 minutes. In the past we used the Ruleset editor, which I really hate because we have quite a big ruleset and it is a nightmare to maintain this rule. (You have to docment seperately what is under the icons). Thanks for your information and kind regards, Wolfgang ------------------------------------------------------------------ Wolfgang Bergbauer Network and System Management Consultant Cell phone: +49 172 534 9131 E-mail: wolfgang.bergbauer@attglobal.net
All events sent by nvserverd go as TEC_ITS_BASE unless you define another default event class in tecint.conf or specifically define an event class in trapd.conf. TEC_ITSBASE replaces the old Nvseverd_Event class as the default class. By the way, the only way you would see events you don't expect over in TEC is if you were using some ruleset other than TEC_ITS.rs or if you modified it. trapd.conf entries ignored? You'd have to prove that to me. Having worked on this code for 7 years, I'm willing to bet that's not true. So what are you expecting that you don't see? James Shanks Level 3 Support for Tivoli NetView for UNIX and Windows Tivoli Software / IBM Software Group
Hi all, After migrating Netview 6.0.3 to Netview 7.1.4 FP01 we see problems with our MLM events. All the MLM events are coming into TEC as TEC_ITS_BASE, with some variables that identify it as MLM/Threshold events, with a generic and specific trapd ID Now 2 issues here: 1. When I look into trapd.conf, there is no TEC Event defined for MLM/Threshold events. How can it go to TEC then as TEC_ITS_BASE. 2. For all our MLM ARM/ReARM events I have specific entries in the trapd.conf with OID of Tivoli/MLM_Threshold {1.3.6.1.4.1.2.6.12.5.1} and a unique specific trap ID. This definition seems to be completely ignored. Thanks for your help. Kind regards, Wolfgang ------------------------------------------------------------------ Wolfgang Bergbauer Network and System Management Consultant Cell phone: +49 172 534 9131 E-mail: wolfgang.bergbauer@attglobal.net |
| <Prev in Thread] | Current Thread | [Next in Thread> |
|---|---|---|
| ||
| Previous by Date: | Re: [nv-l] MLM events in TEC - state correlation, wolfgang . bergbauer |
|---|---|
| Next by Date: | RE: [nv-l] Copying traps--could use an expert explanation, Van Order, Drew \(US - Hermitage\) |
| Previous by Thread: | Re: [nv-l] MLM events in TEC - state correlation, wolfgang . bergbauer |
| Next by Thread: | [nv-l] JVM Replacement, Barr, Scott |
| Indexes: | [Date] [Thread] [Top] [All Lists] |
Archive operated by Skills 1st Ltd
See also: The NetView Web