AW: [nv-l] Event Attributes

["Mildeberger, Thorsten" <thorsten.mildeberger@eds.com>]

Hi Donald,

thanks for your help.

 

To ease up the handling of traps, we added a "inline action" (+ grep command) and a forward node as you suggested,

but I´m curious to know if there could be a more flexible way to handle (check) traps belonging to a defined set of

enterprise ID´s?

 

I was thinking of a inline action node inside a ruleset that runs a grep to text file consting of different enterprise ID´s, but the

problem seems to be the syntax, the enterprise ID (i.e. variable $NVE) is based on. There is no defined amount of digits that

such a enterprise ID does consist of - right?

 

To run a grep against a text file covering all acceptable enterprise traps would be a solution that could be easily maintained as

far as I understand it.

 

Thanks.

 

best regards,

Thorsten Mildeberger

EMS Solutions - SMC Tools & Automation
ITO - Central Region
EDS Deutschland GmbH
Eisenstr. 43
65428 Rüsselsheim
Tel.: +49 (0) 6142 80-3706
Fax.: +49 (0) 6142 80-3030                                      
mailto:thorsten.mildeberger@eds.com

-----Ursprüngliche Nachricht-----
Von: Davis, Donald [mailto:donald.davis@firstcitizens.com]
Gesendet: Donnerstag, 13. Januar 2005 17:02
An: 'nv-l@lists.us.ibm.com'
Cc: Mildeberger, Thorsten
Betreff: RE: [nv-l] Event Attributes

I may be reading more into your question than you meant.
I am going to assume that you would like any "Private Enterprise" trap to trigger some action.
Instead of using the Event Attribute, use the InLine Action to grep for any OID that starts with 1.3.6.1.4.1.

[STREAM]-->[InLineAction]-->[Action]

Configure the [InLineAction] like this:
Command: echo $NVE | grep -E "^1\.3\.6\.1\.4\.1\."
Wait Interval: 1
Exit Code: 0

Don Davis

-----Original Message-----
From: Mildeberger, Thorsten [mailto:thorsten.mildeberger@eds.com]
Sent: Wednesday, January 12, 2005 9:28 AM
To: nv-l@lists.us.ibm.com
Subject: [nv-l] Event Attributes

hi all,
this is more or less a simple question, but I just would like to understand if I got it right.

lets assume traps with the following two enterprise id´s get sent to netview acting as a trap receiver.

the ruleset consists of a "Event Attributes" icon and a "Forward icon" and is set to "Block". the Event Attributes" icon is configured with the "Equal To" operator and set to "1.3.6.1.4.1".

am I right in thinking that traps belonging to enterprise id "1.3.6.1.4.1.674.4413.1.2.3" and "1.3.6.1.4.1.412.2.4.55" for instance would get blocked as the operator was set to "Equal To"?

to let those traps through, TWO "Event Attributes" icons would be needed here, one with enterprise id "1.3.6.1.4.1.674.4413.1.2.3" and one with "1.3.6.1.4.1.412.2.4.55", both having the "Equal To" operator set?

no other chance to get it done in another easier way?

thanks.

best regards,
> Thorsten Mildeberger
>
> EMS Solutions - SMC Tools & Automation
> ITO - Central Region
> EDS Deutschland GmbH
> Eisenstr. 43
> 65428 Rüsselsheim
> Tel.: +49 (0) 6142 80-3706
> Fax.: +49 (0) 6142 80-3030                                      
> mailto:thorsten.mildeberger@eds.com
>

------------------------------------------------------------------------------
This electronic mail and any files transmitted with it are confidential and are intended solely for the use of individual or entity to whom they are addressed. If you are not the intended recipient or the person responsible for delivering the electronic mail to the intended recipient, be advised that you have received this electronic mail in error and that any use, dissemination, forwarding, printing, or copying of this electronic mail is strictly prohibited. If you have received this electronic mail in error, please immediately notify the sender by return mail.
==============================================================================