Re: [nv-l] [EC] State C0rrelation Engine duplicate rule doesn't suppress duplicates

[Leslie Clark <lclark@us.ibm.com>]

Jane, does this mean that you are modifying
the message field on an event on its way to TEC? That is my dream.

Cordially,

Leslie A. Clark
IBM Global Services - Systems Mgmt & Networking
(248) 552-4968 Voicemail, Fax, Pager

Jane Curry <jane.curry@skills-1st.co.uk>
Sent by: owner-nv-l@lists.us.ibm.com

03/10/2005 04:11 PM

Please respond to
nv-l

To	NetView mailing list <nv-l@lists.us.ibm.com>, tme10 <tme10@lists.us.ibm.com>
cc
Subject	[nv-l] [EC] State C0rrelation Engine duplicate rule doesn't suppress duplicates

I have TEC 2.9 FP2 and NetView 7.1.4 FP2 on a SuSE
9.1 Professional system.
I have added 1 extra state correlation engine ( SCE ) rule to the 
provided nvsbrule.xml rules file that comes with NetView:
 <rule id="netview.dupAuthRemove">
    <eventType>TEC_ITS_BASE</eventType>
    <duplicate timeInterval="60000">
    <cloneable attributeSet="hostname"/>
      <predicate>
        <![CDATA[
         &nv_generic == "4"
        ]]>
      </predicate>
    </duplicate>
    <triggerActions>
        <action function="TECSummary"
singleInstance="false">
          <parameters>
             SET:msg="Authentication
Trap Summary"
          </parameters>
        </action>
    </triggerActions>
  </rule>

I am generating 8 traps that match this and I am seeing an event with 
the message "Authentication Trap Summary" so the rule is obviously
firing but I am ALSO seeing all the individual events too.  They all
come from the same hostname inside 60 seconds.  The summary event
has a 
repeat count of 0.

I have tracing and logging turned on for the state correlation but can't
see anything helpful in there.

Anyone else seen this or can see what I have done wrong?  I just have
a 
vague idea I had heard of a bug with the duplicate SCE rule - mebbe on
Linux???

Cheers,
Jane

-- 
Tivoli Certified Consultant & Instructor
Skills 1st Limited, 2 Cedar Chase, Taplow, Bucks, SL6 0EU, UK
Tel: +44 (0)1628 782565
Copyright (c) 2005 Jane Curry <jane.curry@skills-1st.co.uk>.  All
rights reserved.