Since you want to query two different smartsets and take different actions
depending on the results of those queries, it doesn't really matter whether
you have two rules or one. The difference in processing will be tiny
because it is the smartset queries that require all the work. I'd stick
with two separate rules because that would be easier to understand and
maintain. You could alter them independently. You'd have more
complicated logic by combining them and you probably wouldn't get a
measurable change in performance in return.
If these rulesets ran in event windows, then nothing would be shown in
those windows because everything is being blocked. But I'm assuming that
you are planning to run these in ESE.automation, correct? That's the only
way you could have them both active at the same time. And what you run
there has no bearing on the operator's display. When the operator opens
her event window it will be running forwardall.rs by default, or something
else which has an explicit PASS or Forward in it, not one of these.
James Shanks
Level 3 Support for Tivoli NetView for UNIX and Windows
Tivoli Software / IBM Software Group
"Catalina
Martinez"
<Catalina.Martine To
z@tlc.state.tx.us <nv-l@lists.us.ibm.com>
> cc
Sent by:
owner-nv-l@lists. Subject
us.ibm.com [nv-l] Ruleset Question
01/11/2006 04:34
PM
Please respond to
nv-l@lists.us.ibm
.com
Hello,
AIX 5.2 Netview 7.1.4 FP3
General Ruleset question running in ESE.automation:
The rulesets listed below are working ok but wondering if there is more
efficient way of doing this:
do_down.rs -- block --> trap setting = nv60000 node-down --> query
smartset X /if contained in smartset X --> run script A
core_down.rs -- block --> trapsetting == nv6000 node-down --> query
smartset Y/if contained in smartset Y --> run script B
Questions:
1) is it better to have 1 ruleset investigating the same trap; and then
fan out with the different smartset queries /flow. So I would have 2
parallel paths within the same ruleset instead of running 2 separate
rulesets.
2) Does "block" stop the event from the displaying in Main Event window?
The Operators still need to see the event being logged.
3) I normally have "trap setting" first and then the node, can I have
origin first and then the "trap setting". does it matter? which is
better? what's the rule of thumb...
Thanks,
Catalina
|