RE: [nv-l] What's the flow when trapd tec slot mappings are used as well as nvserverd w/ ruleset

[Leslie Clark <lclark@us.ibm.com>]

By the way, I think this is a terrific
feature. I can predefine all sorts of traps to the TEC, with slot mappings,
in case they are ever wanted, and I can include them in the ruleset that
forwards to the TEC, and the Netview Admin can turn them on or off at will
by adjusting the setting in trapd.conf on the fly. If you have nvserverd
tracing turned on, you can see exactly which events are going to the TEC.
The logonly ones don't go. 

Cordially,

Leslie A. Clark
IT Services Specialist, Network Mgmt
Information Technology Services Americas
IBM Global Services
(248) 552-4968 Voicemail, Fax, Pager

Peter Raig/Raleigh/IBM@ibmus
Sent by: owner-nv-l@lists.us.ibm.com

01/24/2006 11:15 AM

Please respond to
nv-l

To	nv-l@lists.us.ibm.com
cc
Subject	RE: [nv-l] What's the flow when trapd tec slot mappings are used as well as nvserverd w/ ruleset

Thanks All, your feedback was right on the money. 
The event stream does go through the ruleset and log only events are indeed
not passed on.

"Foust, Kal E" <kal.foust@eds.com>
Sent by: owner-nv-l@lists.us.ibm.com

01/24/2006 07:51 AM

Please respond to
nv-l@lists.us.ibm.com

To	<nv-l@lists.us.ibm.com>
cc
Subject	RE: [nv-l] What's the flow when trapd tec slot mappings are used as well as nvserverd w/ ruleset

I'm probably missing something here, but how far will it go set to "Log
Only Events"? 

-----Original Message-----
From: owner-nv-l@lists.us.ibm.com [mailto:owner-nv-l@lists.us.ibm.com]
On Behalf Of Jane Curry
Sent: Tuesday, January 24, 2006 5:26 AM
To: nv-l@lists.us.ibm.com
Subject: Re: [nv-l] What's the flow when trapd tec slot mappings are
used as well as nvserverd w/ ruleset

Hi Peter,

The flow of events is from trapd, through nvcorrd (the correlation
engine) and then to nvserverd.  Your nvserverd.conf specifies that
the
NetView correlation rule for nvcorrd to apply to this event stream, is
PRODUCTION_NEW.rs.  Have you remembered to update PRODUCTION_NEW.rs
to
include a forwarding element for the NetView event, trap-a, which is to
be translated to your TEC class of NetBoss???  You can get at the
NetView ruleset editor from the Tools menu.

Try testing your PRODUCTION_NEW.rs ruleset by applying it to a NetView
events dynamic workspace - if it appears there then the same logic
should apply when it is being forwarded to nvserverd.

Peter Raig wrote:

>
>
> I can't seem to figure this out and was hoping someone could help
me
> understand:
>
> I have a trap defined in trapd.conf that has  the TEC slot mapping
> defined:
> trap-a  {1.3.6.1.4.1.290} 6 70000000 N 0 0 "Log Only Events"
> stuffies
> EVENT_CLASS NetBoss
> BEGIN_SLOT_MAPPING
>  source NetBoss
>  sub_origin INFO
>  severity "HARMLESS"
> END_SLOT_MAPPING
> SDESC
> EDESC
>
> And I have nvserverd runing with a ruleset:
> ServerLocation=server
> TecRuleName=PRODUCTION_NEW.rs
> ServerPort=0
> BufferEvents=YES
> UseStateCorrelation=NO
> StateCorrelationConfigURL=file:///usr/OV/conf/nvsbcrule.xml
> ## The following four lines are for debugging the state correlation
> engine LogLevel=ALL # TraceLevel=ALL 
> LogFileName=/usr/OV/log/adptlog.out
> # TraceFileName=/usr/OV/log/adpttrc.out
> #Pre37Server=YES
> #NvserverdTraceTecEvents=YES
>
>
> So the question is when the trap comes in and trapd hands off to 
> nvserverd, does nvserverd process the event through the ruleset or
> just forward it to the tec?
> The customer says it used to work but it recently stopped. I can't
> find any changed files. Other events get to the tec. Turning 
> NvserverdTraceTecEvents on showed other events making to nvserverd
 
> but not mine (don't fully understand where in the flow the trace is)
>
>

--
Tivoli Certified Consultant & Instructor Skills 1st Limited, 2 Cedar
Chase, Taplow, Bucks, SL6 0EU, UK
Tel: +44 (0)1628 782565
Copyright (c) 2006 Jane Curry <jane.curry@skills-1st.co.uk>.  All
rights
reserved.