Hi,
Can someone help me better understand the "Compare MIB Variable" object
works in rulesets? I am trying to build a compliment to a false alarm
node down ruleset (based on the sampcorrNuNd.rs). This ruleset works
very well for node down trap(1st) followed by node up trap (2nd). The
challenge I'm trying to solve is proper notification of a node up trap.
I am trying to validate node up traps are legitimate by running them
through the Compare MIB Variable object and hoping to compare SysUpTime
values. My idea is that if a sysuptime returns a value of less than 15
minutes, then the node really did reboot. If the value is something
greater than that - the node up is probably a false alarm.
The ruleset flow looks like this:
Event Stream -> Event Attribute (#2 with single host name) -> Node Up
Trap -> Compare MIB Variable -> Pager -> Action/Email
When I run an snmpwalk system.sysUpTime I get results like this:
system.sysUpTime.0 = Timeticks: (10547614) 1 day, 5:17:56.14
It looks like about 1000 timeticks= 1 minutes? If I were looking for 15
minutes, I was trying to use (15000) as my value to compare. I've tried
it by itself, with this string : system.sysUpTime.0 = Timeticks: (15000)
Also, I've defined the MIB using it's OID and have specified the Origin
for Object ID Source. I've also manually coded the community string and
have the comparison type set to Less Than.
Running : Netview 7.1.4 on Redhat Linux AS 2.1
Also - can anyone point out a really good source for writing rulesets
(Redbook?) and how do I go about staying on top of patches or fix packs
for Netview?
Thanks,
Glen Warn
PEMCO Corporation Computer Services (PCCS)
glen.warn@pemcocorp.com
206-628-5770
|