RE: [nv-l] [EC] State C0rrelation Engine duplicate rule doesn't s uppress duplicates

[REIBENSCHUH Alfred <alfred.reibenschuh@it-austria.com>]

hi!

ok, i dont know anything about the SCE, but judging from
the xml provided the rule says:

* fire only one(1) "Authentication Trap Summary" event
* for any "nv_generic = 4"
* within 60000 (milli-seconds?)
* for each "hostname"

it does not specify that the duplicate events should be blocked.

shouldn't the following rule be (more) correct (?):

<rule id="netview.dupAuthRemove">
  <eventType>TEC_ITS_BASE</eventType>
  <duplicate timeInterval="60000">
     <cloneable attributeSet="hostname"/>
     <predicate>
       <![CDATA[
        &nv_generic == "4"
       ]]>
     </predicate>
  </duplicate>
  <triggerActions>
    <action function="TECSummary" singleInstance="false">
      <parameters>
        SET:msg="Authentication Trap Summary"
      </parameters>
    </action>
    <action function="Discard" singleInstance="false"/>
  </triggerActions>
</rule>

i may be wrong but that's what i can make out of:
http://publib.boulder.ibm.com/tividd/td/tec/SC32-1234-00/en_US/HTML/ecodmst121.htm

cheers,

--
fredo

Diese Nachricht und allfällige angehängte Dokumente sind vertraulich und nur für den/die Adressaten bestimmt. Sollten Sie nicht der beabsichtigte Adressat sein, ist jede Offenlegung, Weiterleitung oder sonstige Verwendung dieser Information nicht gestattet. In diesem Fall bitten wir, den Absender zu verständigen und die Information zu vernichten. Für Übermittlungsfehler oder sonstige Irrtümer bei Übermittlung besteht keine Haftung.

This message and any attached files are confidential and intended solely for the addressee(s). Any publication, transmission or other use of the information by a person or entity other than the intended addressee is prohibited. If you receive this in error please contact the sender and delete the material. The sender does not accept liability for any errors or omissions as a result of the transmission.

> -----Original Message-----
> From: Jane Curry [mailto:jane.curry@skills-1st.co.uk]
> Sent: Thursday, March 10, 2005 10:12 PM
> To: NetView mailing list; tme10
> Subject: [nv-l] [EC] State C0rrelation Engine duplicate rule doesn't
> suppress duplicates
>
>
> I have TEC 2.9 FP2 and NetView 7.1.4 FP2 on a SuSE 9.1
> Professional system.
> I have added 1 extra state correlation engine ( SCE ) rule to the
> provided nvsbrule.xml rules file that comes with NetView:
>  <rule id="netview.dupAuthRemove">
>     <eventType>TEC_ITS_BASE</eventType>
>     <duplicate timeInterval="60000">
>     <cloneable attributeSet="hostname"/>
>       <predicate>
>         <![CDATA[
>          &nv_generic == "4"
>         ]]>
>       </predicate>
>     </duplicate>
>     <triggerActions>
>         <action function="TECSummary" singleInstance="false">
>           <parameters>
>              SET:msg="Authentication Trap Summary"
>           </parameters>
>         </action>
>     </triggerActions>
>   </rule>
>
> I am generating 8 traps that match this and I am seeing an event with
> the message "Authentication Trap Summary" so the rule is obviously
> firing but I am ALSO seeing all the individual events too.  They all
> come from the same hostname inside 60 seconds.  The summary
> event has a
> repeat count of 0.
>
> I have tracing and logging turned on for the state
> correlation but can't
> see anything helpful in there.
>
> Anyone else seen this or can see what I have done wrong?  I
> just have a
> vague idea I had heard of a bug with the duplicate SCE rule -
> mebbe on
> Linux???
>
> Cheers,
> Jane
>
> --
> Tivoli Certified Consultant & Instructor
> Skills 1st Limited, 2 Cedar Chase, Taplow, Bucks, SL6 0EU, UK
> Tel: +44 (0)1628 782565
> Copyright (c) 2005 Jane Curry <jane.curry@skills-1st.co.uk>. 
> All rights reserved.
>