nv-l
[Top] [All Lists]

[nv-l] [EC] State C0rrelation Engine duplicate rule doesn't suppress dup

To: NetView mailing list <nv-l@lists.us.ibm.com>, tme10 <tme10@lists.us.ibm.com>
Subject: [nv-l] [EC] State C0rrelation Engine duplicate rule doesn't suppress duplicates
From: Jane Curry <jane.curry@skills-1st.co.uk>
Date: Thu, 10 Mar 2005 21:11:51 +0000
Delivery-date: Thu, 10 Mar 2005 21:13:42 +0000
Envelope-to: nv-l-archive@lists.skills-1st.co.uk
Reply-to: nv-l@lists.us.ibm.com
Sender: owner-nv-l@lists.us.ibm.com
User-agent: Mozilla Thunderbird 0.5 (X11/20040208)
I have TEC 2.9 FP2 and NetView 7.1.4 FP2 on a SuSE 9.1 Professional system.
I have added 1 extra state correlation engine ( SCE ) rule to the provided nvsbrule.xml rules file that comes with NetView:
<rule id="netview.dupAuthRemove">
   <eventType>TEC_ITS_BASE</eventType>
   <duplicate timeInterval="60000">
   <cloneable attributeSet="hostname"/>
     <predicate>
       <![CDATA[
        &nv_generic == "4"
       ]]>
     </predicate>
   </duplicate>
   <triggerActions>
       <action function="TECSummary" singleInstance="false">
         <parameters>
            SET:msg="Authentication Trap Summary"
         </parameters>
       </action>
   </triggerActions>
 </rule>

I am generating 8 traps that match this and I am seeing an event with the message "Authentication Trap Summary" so the rule is obviously firing but I am ALSO seeing all the individual events too. They all come from the same hostname inside 60 seconds. The summary event has a repeat count of 0.

I have tracing and logging turned on for the state correlation but can't see anything helpful in there.

Anyone else seen this or can see what I have done wrong? I just have a vague idea I had heard of a bug with the duplicate SCE rule - mebbe on Linux???

Cheers,
Jane

--
Tivoli Certified Consultant & Instructor
Skills 1st Limited, 2 Cedar Chase, Taplow, Bucks, SL6 0EU, UK
Tel: +44 (0)1628 782565
Copyright (c) 2005 Jane Curry <jane.curry@skills-1st.co.uk>.  All rights 
reserved.


<Prev in Thread] Current Thread [Next in Thread>

Archive operated by Skills 1st Ltd

See also: The NetView Web