RE: [nv-l] What's the flow when trapd tec slot mappings are used as well as nvserverd w/ ruleset

[Peter Raig <praig@us.ibm.com>]

Thanks All, your feedback was right
on the money.
The event stream does go through the
ruleset and log only events are indeed not passed on.

"Foust, Kal E" <kal.foust@eds.com>
Sent by: owner-nv-l@lists.us.ibm.com

01/24/2006 07:51 AM

Please respond to
nv-l@lists.us.ibm.com

To	<nv-l@lists.us.ibm.com>
cc
Subject	RE: [nv-l] What's the flow when trapd tec slot mappings are used as well as nvserverd w/ ruleset

I'm probably missing something here, but how far will
it go set to "Log
Only Events"? 

-----Original Message-----
From: owner-nv-l@lists.us.ibm.com [mailto:owner-nv-l@lists.us.ibm.com]
On Behalf Of Jane Curry
Sent: Tuesday, January 24, 2006 5:26 AM
To: nv-l@lists.us.ibm.com
Subject: Re: [nv-l] What's the flow when trapd tec slot mappings are
used as well as nvserverd w/ ruleset

Hi Peter,

The flow of events is from trapd, through nvcorrd (the correlation
engine) and then to nvserverd.  Your nvserverd.conf specifies that
the
NetView correlation rule for nvcorrd to apply to this event stream, is
PRODUCTION_NEW.rs.  Have you remembered to update PRODUCTION_NEW.rs
to
include a forwarding element for the NetView event, trap-a, which is to
be translated to your TEC class of NetBoss???  You can get at the
NetView ruleset editor from the Tools menu.

Try testing your PRODUCTION_NEW.rs ruleset by applying it to a NetView
events dynamic workspace - if it appears there then the same logic
should apply when it is being forwarded to nvserverd.

Peter Raig wrote:

>
>
> I can't seem to figure this out and was hoping someone could help
me
> understand:
>
> I have a trap defined in trapd.conf that has  the TEC slot mapping
> defined:
> trap-a  {1.3.6.1.4.1.290} 6 70000000 N 0 0 "Log Only Events"
> stuffies
> EVENT_CLASS NetBoss
> BEGIN_SLOT_MAPPING
>  source NetBoss
>  sub_origin INFO
>  severity "HARMLESS"
> END_SLOT_MAPPING
> SDESC
> EDESC
>
> And I have nvserverd runing with a ruleset:
> ServerLocation=server
> TecRuleName=PRODUCTION_NEW.rs
> ServerPort=0
> BufferEvents=YES
> UseStateCorrelation=NO
> StateCorrelationConfigURL=file:///usr/OV/conf/nvsbcrule.xml
> ## The following four lines are for debugging the state correlation
> engine LogLevel=ALL # TraceLevel=ALL 
> LogFileName=/usr/OV/log/adptlog.out
> # TraceFileName=/usr/OV/log/adpttrc.out
> #Pre37Server=YES
> #NvserverdTraceTecEvents=YES
>
>
> So the question is when the trap comes in and trapd hands off to 
> nvserverd, does nvserverd process the event through the ruleset or
> just forward it to the tec?
> The customer says it used to work but it recently stopped. I can't
> find any changed files. Other events get to the tec. Turning 
> NvserverdTraceTecEvents on showed other events making to nvserverd
 
> but not mine (don't fully understand where in the flow the trace is)
>
>

--
Tivoli Certified Consultant & Instructor Skills 1st Limited, 2 Cedar
Chase, Taplow, Bucks, SL6 0EU, UK
Tel: +44 (0)1628 782565
Copyright (c) 2006 Jane Curry <jane.curry@skills-1st.co.uk>.  All
rights
reserved.