[nv-l] Ruleset efficiency using Trap Settings versus Event Attributes

["Van Order, Drew \(US - Hermitage\)" <dvanorder@deloitte.com>]

Hi all,

We are testing Compaq traps and there are a considerable number of them
under Compaq's Enterprise ID. Suppose you have 200 traps under one
enterprise ID, but only 15 that need forwarding to TEC. Is it more
efficient to:

1. Use a Trap Settings node set at the enterprise ID 
2. Use a Trap Settings node with only the 15 traps highlighted under the
enterprise ID
3. Use an Event Attributes node set for equal to enterprise ID
4. Use an Event Attributes node for each specific trap (like TEC_ITS)


I think we have a lot of inefficiency in our NV ruleset and like TEC, a
tight ruleset means best event processing. 

Thanks--Drew



This message (including any attachments) contains confidential information 
intended for a specific individual and purpose, and is protected by law.  If 
you are not the intended recipient, you should delete this message.  Any 
disclosure, copying, or distribution of this message, or the taking of any 
action based on it, is strictly prohibited.