Larry, if this is what you see in the log
abcd u [2] private.enterprises.3076.2.1.4.4.37.50
(OctetString): 275850053 07/22/2005 11:10:27.740
SEV=5 IKE/50 RPT=346224 61.108.103.135
Then this is varbind 2, not varbind 3, which is what the [2] is telling
you.
And the variable is equal to the entire string
"275850053 07/22/2005 11:10:27.740 SEV=5 IKE/50 RPT=346224
61.108.103.135"
so to use an Event Attribute ruleset node to pick ou just "IKE/50" your
ruleset would have to specify varbind 2.5, the fifth word of variable 2,
as equal to IKE/50. You have to type the 2.5 into the attribute window
since it is not a scrolling option.
That is what you meant, wasn't it, when you said,
My rule is as below:
event stream ---->Trap settings (VPN OID)----> event stream (NVATTR_3 equal
to IKE/50)----> forward?
That "event stream (NVATTR_3 equal to IKE/50" was supposed to be "event
attribute"? Well, as I read this, it should be "event attribute
Attribute: 2.5 Comparison: equal to Value: IKE/50"
If that doesn't help, try another ruleset first which echoes all the
varbinds out in an action node as an interim step so you can see what they
are
event stream ---->Trap settings (VPN OID)----> action (echovar
script)
This is the echovar script I use:
#!/bin/ksh
#
# The purpose of this script is to echo variables to a file
# to test nvcorrd and actionsvr
#
echo `date` >> /usr/OV/log/echovar.out
echo "count = " $NVATTR_COUNT >> /usr/OV/log/echovar.out
echo "specific = " $NVS >> /usr/OV/log/echovar.out
echo "agent = " $NVA >> /usr/OV/log/echovar.out
echo "time = " $NVT >> /usr/OV/log/echovar.out
echo "var1 = " $NVATTR_1 >> /usr/OV/log/echovar.out
echo "var2 = " $NVATTR_2 >> /usr/OV/log/echovar.out
echo "var3 = " $NVATTR_3 >> /usr/OV/log/echovar.out
echo "var4 = " $NVATTR_4 >> /usr/OV/log/echovar.out
echo "var5 = " $NVATTR_5 >> /usr/OV/log/echovar.out
echo "var6 = " $NVATTR_6 >> /usr/OV/log/echovar.out
echo "var7 = " $NVATTR_7 >> /usr/OV/log/echovar.out
echo "var8 = " $NVATTR_8 >> /usr/OV/log/echovar.out
echo "var9 = " $NVATTR_9 >> /usr/OV/log/echovar.out
#
HTH
James Shanks
Level 3 Support for Tivoli NetView for UNIX and Windows
Tivoli Software / IBM Software Group
|