Yup - it's noddy but that's what it does. This is the bit that works!
Shame about the removal of duplicates though. I believe that the
SET:msg function used here is specific to the TECSummary action - it's
only documented as being possible on the msg field - not tried on
anything else. Other than that, I guess we are in to writing our own
actions - there are some samples on the TEC 3.9 main CD under the EIFDSK
directory hierarchy.
Cheers,
Jane
Leslie Clark wrote:
Jane, does this mean that you are modifying the message field on an
event on its way to TEC? That is my dream.
Cordially,
Leslie A. Clark
IBM Global Services - Systems Mgmt & Networking
(248) 552-4968 Voicemail, Fax, Pager
*Jane Curry <jane.curry@skills-1st.co.uk>*
Sent by: owner-nv-l@lists.us.ibm.com
03/10/2005 04:11 PM
Please respond to
nv-l
To
NetView mailing list <nv-l@lists.us.ibm.com>, tme10
<tme10@lists.us.ibm.com>
cc
Subject
[nv-l] [EC] State C0rrelation Engine duplicate rule doesn't suppress
duplicates
I have TEC 2.9 FP2 and NetView 7.1.4 FP2 on a SuSE 9.1 Professional
system.
I have added 1 extra state correlation engine ( SCE ) rule to the
provided nvsbrule.xml rules file that comes with NetView:
<rule id="netview.dupAuthRemove">
<eventType>TEC_ITS_BASE</eventType>
<duplicate timeInterval="60000">
<cloneable attributeSet="hostname"/>
<predicate>
<![CDATA[
&nv_generic == "4"
]]>
</predicate>
</duplicate>
<triggerActions>
<action function="TECSummary" singleInstance="false">
<parameters>
SET:msg="Authentication Trap Summary"
</parameters>
</action>
</triggerActions>
</rule>
I am generating 8 traps that match this and I am seeing an event with
the message "Authentication Trap Summary" so the rule is obviously
firing but I am ALSO seeing all the individual events too. They all
come from the same hostname inside 60 seconds. The summary event has a
repeat count of 0.
I have tracing and logging turned on for the state correlation but can't
see anything helpful in there.
Anyone else seen this or can see what I have done wrong? I just have a
vague idea I had heard of a bug with the duplicate SCE rule - mebbe on
Linux???
Cheers,
Jane
--
Tivoli Certified Consultant & Instructor
Skills 1st Limited, 2 Cedar Chase, Taplow, Bucks, SL6 0EU, UK
Tel: +44 (0)1628 782565
Copyright (c) 2005 Jane Curry <jane.curry@skills-1st.co.uk>. All
rights reserved.
--
Tivoli Certified Consultant & Instructor
Skills 1st Limited, 2 Cedar Chase, Taplow, Bucks, SL6 0EU, UK
Tel: +44 (0)1628 782565
Copyright (c) 2005 Jane Curry <jane.curry@skills-1st.co.uk>. All rights
reserved.
|