|
James
& Leslie,
Thanks
for your always insightful responses! You got me headed in the right
direction.
I
was stopping/starting actionsvr every time I made a change to the ruleset
and there
were not any events displays subscribed to that
ruleset.
However, what I did find was that nvcorrd.alog (or blog) was also logging
the events twice.
I
recycled nvcorrd and the duplicate events/execution went
away.
I
still don't understand what was causing that, but it's working correctly
now.
Have a
great New Year!
Don
Davis
Leslie's correct about that being one source. Another is that if you change
ESE.automation, you still have to stop and restart actionsvr, because he
doesn't read the ESE.automation file, except at start up, and nvcorrd will
just keep his old session(s) with the old rulesets going.
The nvcorrd
trace will tell you all the rulesets being run at any given time if you
issue
nvcdebug -n
so that's one way to see how many copies are being
run.
And if anyone else is running a prior copy, then that will still
be used even if you change the actual ruleset. nvcorrd loads it when the
registered process starts its session. You have to stop that process and
restart it to get the new copy. So you can even have two processes (two event
windows for example, or an event window and actionsvr) running rulesets with
the same name that are actually different code, if you aren't very careful
about it.
I don't mean to imply you aren't careful, Don, just trying
to explicate the process.
HTH
James Shanks
Level 3 Support for
Tivoli NetView for UNIX and Windows
Tivoli Software / IBM Software
Group
 Leslie
Clark/Southfield/IBM@IBMUS
Leslie
Clark/Southfield/IBM@IBMUS
Sent by:
owner-nv-l@lists.us.ibm.com
01/05/2005 11:01 AM
|
|
Any
chance that there is an events display subscribed to that ruleset?
Cordially,
Leslie A. Clark
IBM Global Services - Systems
Mgmt & Networking
(248) 552-4968 Voicemail, Fax, Pager
"Davis, Donald"
<donald.davis@firstcitizens.com>
Sent
by: owner-nv-l@lists.us.ibm.com
01/05/2005 10:17 AM
|
|
To |
"'nv-l@lists.us.ibm.com'"
<nv-l@lists.us.ibm.com> |
|
cc |
 |
|
Subject |
[nv-l] actionsvr
problem |
|
I am experiencing some strange
actionsvr behavior.
I created
a fairly simple ruleset like this:
[STREAM (block)]--->[InLineAction (echo $NVA | grep
....)]--->[ACTION(pageIS.pl ....)]
It fires twice instead of just once for each matching event.
So, I removed it from ESE.automation, it still fires once per matching
event.
I removed everything
from ESE.automation and it still fires once per matching trap.
Note that the 4th line in the
nvaction.alog indicates "No user defined ruleset found", and then it proceeds
to execute my ruleset anyway.
I modified the ruleset and put it back in ESE.automation. Now
actionsvr executes the new version and the old version.
Are rulesets cached somewhere? I thought
stopping/starting actionsvr was all that was necessary.
What is happening here?
Don Davis
2005/04/01 18:53:45 : --------- ESE actionsvr log v1.0
-----------
2005/04/01 18:53:45 : local host is dcncsrvrmsq30
2005/04/01
18:53:45 .//nl_Actionsvr.C[269] : Filtering all non alpha-numeric characters
from trap strings with the exception of: -.
2005/04/01 18:53:45 : No user
defined ruleset found in /usr/OV/conf/ESE.automation.
2005/04/01 18:54:05 :
1 :/usr/local/Tivoli/scripts/pageIS.pl $NVA $NVE $NVG $NVS $NVATTR_1 $NVATTR_2
$NVATTR_3 $NVATTR_4 &~2005/04/01
18:54:05~1.3.6.1.4.1.2.6.3.1~6~50790412~2887520268~133566~public~16~172.28.16.12~Ping
on 172.28.16.12.~PING: Down~openview~7~n~1
2005/04/01 18:54:05
.//nl_Actionsvr.C[822] : Varbind contained an illegal character. Issuing
sanitized version of the varbind:
2005/04/01 18:54:05
.//nl_Actionsvr.C[823] : NVATTR_2="172\.28\.16\.12"
2005/04/01 18:54:05
.//nl_Actionsvr.C[822] : Varbind contained an illegal character. Issuing
sanitized version of the varbind:
2005/04/01 18:54:05
.//nl_Actionsvr.C[823] : NVATTR_3="Ping on 172\.28\.16\.12\."
2005/04/01
18:54:05 .//nl_Actionsvr.C[822] : Varbind contained an illegal character.
Issuing sanitized version of the varbind:
2005/04/01 18:54:05
.//nl_Actionsvr.C[823] : NVATTR_4="PING_ Down"
------------------------------------------------------------------------------
This
electronic mail and any files transmitted with it are confidential and are
intended solely for the use of individual or entity to whom they are
addressed. If you are not the intended recipient or the person responsible for
delivering the electronic mail to the intended recipient, be advised that you
have received this electronic mail in error and that any use, dissemination,
forwarding, printing, or copying of this electronic mail is strictly
prohibited. If you have received this electronic mail in error, please
immediately notify the sender by return
mail.
==============================================================================
|