Hello,
AIX 5.2 Netview 7.1.4 FP3
General Ruleset question running in ESE.automation:
The rulesets listed below are working ok but wondering if there is more
efficient way of doing this:
do_down.rs -- block --> trap setting = nv60000 node-down --> query
smartset X /if contained in smartset X --> run script A
core_down.rs -- block --> trapsetting == nv6000 node-down --> query
smartset Y/if contained in smartset Y --> run script B
Questions:
1) is it better to have 1 ruleset investigating the same trap; and then
fan out with the different smartset queries /flow. So I would have 2
parallel paths within the same ruleset instead of running 2 separate
rulesets.
2) Does "block" stop the event from the displaying in Main Event window?
The Operators still need to see the event being logged.
3) I normally have "trap setting" first and then the node, can I have
origin first and then the "trap setting". does it matter? which is
better? what's the rule of thumb...
Thanks,
Catalina
|