[Top] [All Lists]

RE: [nv-l] Ruleset Question

To: <nv-l@lists.us.ibm.com>
Subject: RE: [nv-l] Ruleset Question
From: "Catalina Martinez" <Catalina.Martinez@tlc.state.tx.us>
Date: Tue, 17 Jan 2006 09:06:44 -0600
Delivery-date: Tue, 17 Jan 2006 15:07:21 +0000
Envelope-to: nv-l-archive@lists.skills-1st.co.uk
Reply-to: nv-l@lists.us.ibm.com
Sender: owner-nv-l@lists.us.ibm.com
Thread-index: AcYXr3F2ZpWdo7HFQ4azyS06ncGuXgDx4L9A
Thread-topic: [nv-l] Ruleset Question
Thanks James. I did open a call with Support.

In the meantime, I have a question on the "flow" process within a

1) on the ruleset itself...which is the correct method or does it really

event stream --> Query Smartset --> Trap Settings --> Action
event stream --> Trap Setting --> Query Smartset --> Action

In particular the NODE DOWN TRAP, I only want to process the action if
the node exists in the smartset.

2) within the  "trap setting" configuration, can I select multiple traps
within  the same EID? for example:

nv6000 can I select both 58916865 and 58916867  or have 2 separate "trap
settings" symbols?

on both 1 and 2 is there a preferred method.

-----Original Message-----
From: owner-nv-l@lists.us.ibm.com [mailto:owner-nv-l@lists.us.ibm.com]
On Behalf Of James Shanks
Sent: Thursday, January 12, 2006 1:36 PM
To: nv-l@lists.us.ibm.com
Subject: RE: [nv-l] Ruleset Question


I can't do this for you.  You'd have to call Support for that kind of
But I can make some general observations and give you enough to get
But understand that you are asking for programming assistance.  That's
something that just anyone can give you.  I take it that you did not
the original?  If you did, then you should be able to get this working
what I am about to tell you.

Your script gets passed $A and $4 from trapd.  It references those
variables as $1 and $2 internally,
What you want to do is use the ruleset environment variables for the
things in your script, in place of $1 and  $2.
So in your script $1 become $NVA , the agent address, and $4 becomes
$NVATTR_4, the port number.
You need not pass it anything.

If it doesn't perform as expected, you can look in the nvaction.alog and
blog where the output from Action nodes run by actionsvr is logged.  If
need to see your script traced to debug it, then add
      set -x
as the first line and it will trace to the active nvaction log.

Testing is going to be difficult, but no more difficult than it was to
the original one.  You would have to construct an snmptrap script to
send a
dummy trap that looks like what you expect to get.  That's the only way
test a an automatic action being triggered from a trap or from a
It doesn't have to be perfect.  It just has to produce a trap similar
enough to what you need to trigger the action.   This should be enough
get you started.

# cisco_workgroup test trap
# The first line shows the word hostname in back ticks,
#  which means to use the output  of  the hostname command
#  as the trap destination.  The hostname on the second line
#   must be valid in your network or replaced by an IP address.
#  The numeral 1 on the second line is the specific trap number;
#   replace it if this is not correct.
#   The OIDs are made up.  Any set of arbitrary numbers would do.
#   Since only four varbinds are needed, only four are sent.
#  Except for a port number in varbind 4, their contents is fake as
#  I am not sure about the exact format of the port number either
/usr/OV/bin/snmptrap    `hostname`  . \
  'whiskey.raleigh.ibm.com'  6 1 10 \
  .  Integer  20 \
  .  Integer  4  \
  .  OctetStringascii  "dummy test trap" \
  .  OctetStringascii  "#10/6" \

Your original script does not put all the varbinds of the trap in the
windows or the e-mail message.  To do that you'd have to modify it to
include the variable contents $NVATTR_1, $NVATTR_2, $NVATTR_3,  and so
for as many variables as there are in the trap,  in the echo statements
the output.

Hope this helps,

James Shanks
Level 3 Support  for Tivoli NetView for UNIX and Windows
Tivoli Software / IBM Software Group




             z@tlc.state.tx.us         <nv-l@lists.us.ibm.com>

             Sent by:

             us.ibm.com                RE: [nv-l] Ruleset Question



             01/12/2006 10:05




             Please respond to





Thanks James,

Initially, my script was executed from within the trap customization /
command section and now I want to move the process to a ruleset.

cisco_workgroup "LINK_DOWN" Trap
command for automatic action:/usr/local/bin/netview_dore_down $A $4

$A == device name
$4 == port number

The script itself does an snmpget on the device to get the port name. I
took care of all the special characters and such. Generates a popup
messages which contains the device and port name. This process works

uses the same script. but in the ruleset, the values are not sent so the
script does not work properly. How do I export the values within a
ruleset? I've tried $NVA, $A, and then I read somewhere (cant remember
where) not to export anything in the rulesets that all values are there
but modify the script. I just need the node name and variable 4 sent to
my script.

Other questions:
How do I test a ruleset/trap? server setup?
How do I generate a popup with all the trap values? $* on the popup
notification  field.

This is my script:
# /usr/local/bin/netview_core_down_alert
# The script will take a device name and port number
# and produce the port name.
# If the name begins with NET a popup window and email
# are sent.
# The statement below will replace / with an . for port number#
# IN NV712 port numbers exported with _
stamp=`date +"%D-%T"`
port=`echo $2 | tr '_' '.'`
port1=`echo $2 | tr '_' '/'`
# the statement below will do an snmpget to get the port name
portname=`/usr/OV/bin/snmpget $1 .$port`
# Now we take the first 3 letters of the name
prefix=`echo $name | cut -c 1-4`
#If the 4 letters match NET- then display window and send email
if test "$prefix" = "NET-"
      /usr/OV/bin/ovxbeep -b 10 -display OPS:0.0 "`echo $stamp $1
reports Port $port1 link to $name is DOWN--Call NWC!| /usr/bin/fold -b
-s -w 18`"&

echo $stamp $1 $name | mail -s "CORE LINK DOWN" online lsg ops
exit 0

-----Original Message-----
From: owner-nv-l@lists.us.ibm.com [mailto:owner-nv-l@lists.us.ibm.com]
On Behalf Of James Shanks
Sent: Wednesday, January 11, 2006 3:50 PM
To: nv-l@lists.us.ibm.com
Subject: Re: [nv-l] Ruleset Question

Since you want to query two different smartsets and take different
depending on the results of those queries, it doesn't really matter
you have two rules or one.  The difference in processing will be tiny
because it is the smartset queries that require all the work.  I'd stick
with two separate rules because that would be easier to understand and
maintain.  You could alter them independently.   You'd have more
complicated logic by combining them and  you probably wouldn't get a
measurable change in performance in return.

If these rulesets ran in event windows, then nothing would be shown in
those windows because everything is being blocked.  But I'm assuming
you are planning to run these in ESE.automation, correct?  That's the
way you could have them both active at the same time.    And what you
there has no bearing on the operator's display.  When the operator opens
her event window it will be running forwardall.rs by default,  or
else which has an explicit PASS or Forward in it, not one of these.

James Shanks
Level 3 Support  for Tivoli NetView for UNIX and Windows
Tivoli Software / IBM Software Group



             z@tlc.state.tx.us         <nv-l@lists.us.ibm.com>

             Sent by:

             us.ibm.com                [nv-l] Ruleset Question

             01/11/2006 04:34


             Please respond to




AIX 5.2 Netview 7.1.4 FP3

General Ruleset question running in ESE.automation:

The rulesets listed below are working ok but wondering if there is more
efficient way of doing this:

do_down.rs -- block --> trap setting = nv60000 node-down --> query
smartset X /if contained in smartset X --> run script A

core_down.rs -- block --> trapsetting == nv6000 node-down --> query
smartset Y/if contained in smartset Y --> run script B

1) is it better to have 1 ruleset investigating the same trap; and then
fan out with the different smartset queries /flow. So I would have 2
parallel paths within the same ruleset instead of running 2 separate

2) Does "block" stop the event from the displaying in Main Event window?
The Operators still need to see the event being logged.

3) I normally have "trap setting" first and then the node, can I have
origin first and then the "trap setting". does it matter? which is
better? what's the rule of thumb...



<Prev in Thread] Current Thread [Next in Thread>

Archive operated by Skills 1st Ltd

See also: The NetView Web