nv-l
[Top] [All Lists]

Re: [nv-l] [EC] State C0rrelation Engine duplicate rule doesn't suppress

To: nv-l@lists.us.ibm.com
Subject: Re: [nv-l] [EC] State C0rrelation Engine duplicate rule doesn't suppress duplicates
From: Leslie Clark <lclark@us.ibm.com>
Date: Thu, 10 Mar 2005 19:29:00 -0500
Delivery-date: Fri, 11 Mar 2005 00:29:39 +0000
Envelope-to: nv-l-archive@lists.skills-1st.co.uk
In-reply-to: <4230B817.80704@skills-1st.co.uk>
Reply-to: nv-l@lists.us.ibm.com
Sender: owner-nv-l@lists.us.ibm.com

Jane, does this mean that you are modifying the message field on an event on its way to TEC? That is my dream.

Cordially,

Leslie A. Clark
IBM Global Services - Systems Mgmt & Networking
(248) 552-4968 Voicemail, Fax, Pager



Jane Curry <jane.curry@skills-1st.co.uk>
Sent by: owner-nv-l@lists.us.ibm.com

03/10/2005 04:11 PM
Please respond to
nv-l

To
NetView mailing list <nv-l@lists.us.ibm.com>, tme10 <tme10@lists.us.ibm.com>
cc
Subject
[nv-l] [EC] State C0rrelation Engine duplicate rule doesn't suppress duplicates





I have TEC 2.9 FP2 and NetView 7.1.4 FP2 on a SuSE 9.1 Professional system.
I have added 1 extra state correlation engine ( SCE ) rule to the
provided nvsbrule.xml rules file that comes with NetView:
<rule id="netview.dupAuthRemove">
   <eventType>TEC_ITS_BASE</eventType>
   <duplicate timeInterval="60000">
   <cloneable attributeSet="hostname"/>
     <predicate>
       <![CDATA[
        &nv_generic == "4"
       ]]>
     </predicate>
   </duplicate>
   <triggerActions>
       <action function="TECSummary" singleInstance="false">
         <parameters>
            SET:msg="Authentication Trap Summary"
         </parameters>
       </action>
   </triggerActions>
 </rule>

I am generating 8 traps that match this and I am seeing an event with
the message "Authentication Trap Summary" so the rule is obviously
firing but I am ALSO seeing all the individual events too.  They all
come from the same hostname inside 60 seconds.  The summary event has a
repeat count of 0.

I have tracing and logging turned on for the state correlation but can't
see anything helpful in there.

Anyone else seen this or can see what I have done wrong?  I just have a
vague idea I had heard of a bug with the duplicate SCE rule - mebbe on
Linux???

Cheers,
Jane

--
Tivoli Certified Consultant & Instructor
Skills 1st Limited, 2 Cedar Chase, Taplow, Bucks, SL6 0EU, UK
Tel: +44 (0)1628 782565
Copyright (c) 2005 Jane Curry <jane.curry@skills-1st.co.uk>.  All rights reserved.


<Prev in Thread] Current Thread [Next in Thread>

Archive operated by Skills 1st Ltd

See also: The NetView Web