|
James
(and list),
I'm
back from testing with success, thank you very much. I prefer the ruleset one
since it has more power and flexibility. Unfortunately, more questions coming
when I know more.
1) How
can I make it permanent (filter and ruleset) for the default event window (the
first one open)?
2) Can
I assume that when I use either of them, the event will also be blocked to the
TEC since we have the TEC integration?
3)
What if I have more traps (e.g. 5 tarps) with more sources (100 hosts) to
block?
BTW, I
have NV 7.1.2 on Solaris.
Waiting for your advice.
Regards,
David
What you are doing has nothing to do with excluding traps from the event
window, nothing at all.
The source box in the event configuration panels is
there so that you can format the same trap from different sources in a
different way. First you make a copy of the Interface Down trap, giving it a
new name. Then you add your sources, and finally, you change the formatting or
the command for automatic action. But none of that will force an event off the
screen. It just allows a different display when it comes in.
To exclude
traps from the event windows screen you must either use a filter or a ruleset
to do the job.
To build a filter, pull down Options --> Filter
Control and then click the button to start the filter editor. You are going to
do an Add Simple (filter) so click that button. Now a filter is for filtering
in (not out) what you want to see. So you would click the radio button for
"Events Not Equal To Selected" and then pick out Interface Down from the list.
Click Add/Modify to get the list selection box and pick out Interface Down.
Then go on the second part and identify the hosts to be excluded ("From
Objects not Equal to List"). Once you've identified the hosts and the trap you
want to exclude, give the filter a name and a short description and save it by
clicking OK. When you exit the editor and go back to the filter control
window, then you will see your new filter in the list of those which can be
activated. Select it and activate it. From that point on you will not see the
trap in the event window. Every time you restart the window you will have to
re-apply the filter, unless you make some more elaborate changes to the way
nvevents works. All this is covered in elaborate detail in the NetView for
UNIX Administrator's guide, but if you get your filter working and you then
want to apply it automatically, ask again and we'll go over that part. Right
now you should just be testing the filter. If you bring up an other events but
don't apply the filter you should be able to see the difference when the
Interface Down traps from the excluded hosts come in.
Building a
ruleset is considerably more complicated.
To build a ruleset, you use the
ruleset editor, nvrsEdit. If you bring that up, you get two windows, a box of
multiple icons called templates and a workspace window which allows you to
build and edit rulesets. On the workspace panel, do File --> Open and
you'll see a sample called sampcorrIuId.rs.
Open that one and edit it. Pull
down Edit --> Delete Node and your cursor will tun into a little hammer.
Use it to smash the Resolve node icon, the Pass-on-Match node icon, and the
bottom Trap Settings node icon, which is the one for Interface Up. (You can
see that if you double-click on it). You should be left with just the Event
Stream icon (which looks like a purple pizza) with an arrow pointing to a Trap
Settings node icon, which if you double click it, will bring up a panel and
show you what trap is selected. It should be Interface Down. If it is not,
then make it so.
Next you'll be adding two Event Attributes node
icons. Find that on from the Templates display. Drag and drop it down onto the
ruleset. It will open a panel which will allow you to specify what attribute
you want. Select 2, which is the hostname in the Interface Down Trap, and then
make the comparison be Equal To, and finally fill in the value of one of the
hostnames you want to exclude. OK your way out. Now repeat that process. Drag
down another Event Attributes block, and make it equal to the other hostname
you want to exclude. Now you have to connect those two Event Attribute nodes
to the Trap Settings node.
Use the Edit --> Connect two nodes
function for this. Pull down Edit -> Connect two nodes and your cursor will
change to a semaphore signal with the left side highlighted. Position it over
the Traps Settings node and left click. The cursor semaphore will now
highlight the right side. Position it over either one of the Event Attributes
node and left click. The cursor will revert to normal and there will now be an
arrow from the Trap Settings node to that Event Attributes node. Repeat that
process with the other Event Attributes node. You should end up with two
arrows going from the Trap settings node, one to each of the Event Attribute
nodes. At this point is will be helpful to pull down Edit --> Refresh
Layout , which will clean up the picture and make it easier to
see.
Next you'll be adding a Block event node icon from the Templates
display. Drag and drop it down onto the ruleset. It will open a panel which
will allow you to append a comment if you like. Do that or just click OK, so
that you now have it on the workspace panel with the other icons. The editor
will automatically connect it to the last Event Attributes icon. That's fine;
it's just one less thing you have to do. Pull down Edit -> Connect two
nodes, and this time connect the other Event Attributes box to the very same
Block event node.
At this point you are finished editing and should
save your ruleset. Pull down File--> Save As, and give your ruleset a new
name of your own choosing. Don't change the path. Leave it in the
/usr/OV/conf/rulesets directory. Then exit the editor.
To activate you
ruleset, bring up the events window. Once initialized, pull down Create -->
Dynamic Workspace and on the resulting panel click the Rules List box and
select the ruleset you just created. You can give this new workspace a title
if you like (it defaults to Dynamic Filtered Workspace 1) or just hit the OK
button in the lower left and get it created. Now you have two event
workspaces, one running the default ruleset forwardall.rs, the other running
your ruleset. This allows you to test yours. When the Interface Down traps
from the hosts to be excluded come in, they will be shown on the original
workspace, the one running forwardall.rs, but not on yours.
Once your
ruleset has been tested, then you can decide whether you want to make it
permanent or not, and for you or everyone. When you are ready to decide that
step, you can ask on the list again.
So there you have it. That's how
to use filters or rulesets to control the event display in NetView for
Windows.
Take your pick.
James Shanks
Level 3 Support for Tivoli
NetView for UNIX and Windows
Tivoli Software / IBM Software Group
 "Liu, David"
<david.liu@eds.com>
"Liu, David"
<david.liu@eds.com>
Sent by:
owner-nv-l@lists.us.ibm.com
03/02/2005 07:33 AM
|
|
Dear list,
I have experienced following problem hope to get your
advices.
For
the Netview6000 traps I need to exclude some source hosts from the interface
down trap. I choose from GUI the Options... Event configuration: trap
configuration... SNMP the find the specific trap (internal number 58916867). I
selected modify and in the source field add all hosts except two which I want
to exclude. But after that this trap for these two hosts still appear on the
event window. Does anyone has the similar experience before? Thank you in
advance.
Regards,
David
|
