Working on a new environment setup of TEC/Netview.
Like a lot of what's in the products as far as rules and such.
Planning to implement the following event policy:
- Clearing Events from NetView remain open XX minutes. After that time,
they are automatically closed.
My intent is not to alter the underlying correlations in netview.rls at
all.
If a correlation closed or changes something already, let it do so.
In fact the way the rules work now, they do a very good job at this.
But the events that ultimately resolve an ERN (event relationship
network) remain open.
I would like to close them automatically after a reasonable amount of
time (xx minutes).
My thoughts are to add set_timer predicates to each event that passes
through any
of the *_lower rules:
interface_lower
isdn_lower
snmp_lower
node_lower
router_lower
subnet_lower
interface_added_lower
interface_managed_lower
node_added_lower
node_managed_lower
sa_status_lower
l2_status_lower
Then I can add a timer_rule into the set: if event is still open, then
close.
Anything already closed by existing rules isn't impacted.
Those 'lingering' open, harmless events are closed.
Thought I give anyone else which some experience with the ruleset a
chance to chime in with
their thoughts.
My gut after studing the ruleset is that:
- no current rules or behaviors are impacted
- any re-analysis shouldn't be impacted either
Input is appreciated.
Jon Austin
Tivoli/Unix Administrator
Information Systems
Children's Hospital of Philadelphia
|