We exclusively use postemessage and vendors OIDS as well. WE do not use TEC
SLOTS or Netview traps.
Out trapd is very busy, but we are pretty selective in the OIDs we are
interested in. Through scripting we can further select certain conditions
that would constitute an alterable condition, filter off the uninteresting
conditions, classify as harmless event for later correlation, or create
custom user friendly messages. This off loads tec significantly in some it's
decision making and simplifies correlation rules.
In a busy environment you need to consider what is important for your
business and only send what you need from the source device.
-js
-----Original Message-----
From: owner-nv-l@lists.us.ibm.com [mailto:owner-nv-l@lists.us.ibm.com]On
Behalf Of Gerardo Ruiz Garcia
Sent: Tuesday, March 14, 2006 5:00 AM
To: nv-l@lists.us.ibm.com
Subject: Re: [nv-l] ovactiond problem
Thanks for all the suggestions, the main probelm is to deal with a 10-20
traps/sec envirorment.
With the TEC adapter a lot of events never reach the TEC the same way not
all events are shown in a Workspace that as a 10 minutes delay.
I will try with the -w 0 option in ovactiond.
Thanks again.
>-- Mensaje Original --
>Date: Mon, 13 Mar 2006 13:30:48 +0000
>From: Jane Curry <jane.curry@skills-1st.co.uk>
>To: nv-l@lists.us.ibm.com
>Subject: Re: [nv-l] ovactiond problem
>Reply-To: nv-l@lists.us.ibm.com
>
>
>It is perfectly possible with NetView on Unix, to configure NetView to
>convert your own TRAPs to TEC events and forward them with nvserverd.
> From Options -> TTrap Configuration, use the boxes in the middle of the
>
>panel to specify the TEC class you want to convert to and use the "Slot
>mapping" box to specify how to map TRAP varbinds into TEC slots. You
>obviously also need to do the work on your TEC Server to configure in
>baroc files that match up with what you configure in Netview. You can
>specify ant class you wish.
>
>If you leave the TEC Class field empty in trap configuration, then it
>defaults to TEC_ITS_BASE.
>
>That way, you get the benefits James described of having NetView daemons
>
>that are optimised to forward to TEC, rather than having ovactiond run
>wpostemsg.
>
>Cheers,
>Jane
>
>Gerardo Ruiz Garcia wrote:
>
>>The main reason is to create our own classes in TEC, and fill the message
>>fields in TEC with aditional information.
>>We send trapss from enterprises that do not suplly TEC baroc files
(baseboard
>>from Dell Servers and RAID alert), so we heve create our own class with
>>our own slots . THat the reason of execute and script to send an alert
to
>>TEC.
>>No Netview events ate send to TEC, only private enterprises traps
definition.
>>
>>
>>>-- Mensaje Original --
>>>Subject: Re: [nv-l] ovactiond problem
>>>To: nv-l@lists.us.ibm.com
>>>From: James Shanks <jshanks@us.ibm.com>
>>>Date: Thu, 9 Mar 2006 12:50:26 -0500
>>>Reply-To: nv-l@lists.us.ibm.com
>>>
>>>
>>>Is there some reason why you would choose this method of the internal
TEC
>>>adapter in nvserverd? That method is optimized by having nvcorrd pick
>>>
>>>
>>out
>>
>>
>>>the correct events to send and then having nvserverd do the formatting
>>>
>>>
>>and
>>
>>
>>>sending (two daemons rather than one share the processing).
>>>
>>>Using a ruleset and the internal adapter is far more efficient than using
>>>wpostemsg from a script if you are going to send a lot of events.
>>>But I don't see how setting the -w to zero could hurt you, since the
TEC
>>>server can handle out-of-sequence events if that becomes an issue. The
>>>thing is that once the scripts are launched, you have no control of which
>>>one(s) the operating system gives priority to. Usually it's FIFO but
you
>>>never know.
>>>
>>>Anybody else sending events to TEC with using postemsg or wpostemsg have
>>>something they'd like to share?
>>>
>>>James Shanks
>>>Level 3 Support for Tivoli NetView for UNIX and Windows
>>>Tivoli Software / IBM Software Group
>>>
>>>
>>>
>>>
>>>
>>
>>
>>
>>>
>>> "Gerardo Ruiz
>>>
>>>
>>
>>
>>
>>>
>>> Garcia"
>>>
>>>
>>
>>
>>
>>>
>>> <gerardo_ruiz@ini
>>>
>>>
>> To
>>
>>
>>> cia.es> nv-l@lists.us.ibm.com
>>>
>>>
>>
>>
>>
>>>
>>> Sent by:
>>>
>>>
>> cc
>>
>>
>>> owner-nv-l@lists.
>>>
>>>
>>
>>
>>
>>>
>>> us.ibm.com Subject
>>>
>>> Re: [nv-l] ovactiond problem
>>>
>>>
>>
>>
>>
>>>
>>>
>>>
>>>
>>
>>
>>
>>>
>>> 03/09/2006 12:36
>>>
>>>
>>
>>
>>
>>>
>>> PM
>>>
>>>
>>
>>
>>
>>>
>>>
>>>
>>>
>>
>>
>>
>>>
>>>
>>>
>>>
>>
>>
>>
>>>
>>> Please respond to
>>>
>>>
>>
>>
>>
>>>
>>> nv-l@lists.us.ibm
>>>
>>>
>>
>>
>>
>>>
>>> .com
>>>
>>>
>>
>>
>>
>>>
>>>
>>>
>>>
>>
>>
>>
>>>
>>>
>>>
>>>
>>
>>
>>
>>>
>>>
>>>
>>>
>>>
>>>The design is tio execute an script for each event that means a TEC
message
>>>executng a wpostemsg comand in the script.
>>>In this way we can create our own class definition
>>>The mayor traps are received from Cisco Router snmp agent: interface
limks,
>>>environment problems etc..
>>>Only a few tarps or events are configured to send wpostemsg to TEC, but
>>>the rate of traps/events makes ovactiond disconect from trapd.
>>>I do not understand the meaning of serializing a resource.
>>>
>>>Thanks for the comments I will try to set -W to cero and inncrease size
>>>of trapd.
>>>What is your opinion of the desing for TEC connection.?
>>>
>>>
>>>
>>>
>>>>-- Mensaje Original --
>>>>Subject: Re: [nv-l] ovactiond problem
>>>>To: nv-l@lists.us.ibm.com
>>>>From: James Shanks <jshanks@us.ibm.com>
>>>>Date: Thu, 9 Mar 2006 08:03:02 -0500
>>>>Reply-To: nv-l@lists.us.ibm.com
>>>>
>>>>
>>>>Probably so, especially if you are serializing on some resource. What
>>>>
>>>>
>>>is
>>>
>>>
>>>>it that you are trying to do?
>>>>
>>>>James Shanks
>>>>Level 3 Support for Tivoli NetView for UNIX and Windows
>>>>Tivoli Software / IBM Software Group
>>>>
>>>>
>>>>
>>>>
>>>>
>>>> "Gerardo Ruiz
>>>>
>>>>
>>>> Garcia"
>>>>
>>>>
>>>> <gerardo_ruiz@ini
>>>>
>>>>
>>>To
>>>
>>>
>>>> cia.es> nv-l@lists.us.ibm.com
>>>>
>>>>
>>>> Sent by:
>>>>
>>>>
>>>cc
>>>
>>>
>>>> owner-nv-l@lists.
>>>>
>>>>
>>>> us.ibm.com
Subject
>>>>
>>>> Re: [nv-l] ovactiond problem
>>>>
>>>>
>>>>
>>>>
>>>> 03/09/2006 04:53
>>>>
>>>>
>>>> AM
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>> Please respond to
>>>>
>>>>
>>>> nv-l@lists.us.ibm
>>>>
>>>>
>>>> .com
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>I have a question to the option wait -w set to cero.
>>>>THat it means that the script are executed in background? , so I have
>>>>
>>>>
>>to
>>
>>
>>>>develop the scripts in a way that several instances of the script can
>>>>
>>>>
>>we
>>
>>
>>>>executed at the same time.
>>>>
>>>>
>>>>
>>>>>-- Mensaje Original --
>>>>>Subject: Re: [nv-l] ovactiond problem
>>>>>To: nv-l@lists.us.ibm.com
>>>>>From: James Shanks <jshanks@us.ibm.com>
>>>>>Date: Wed, 8 Mar 2006 09:14:26 -0500
>>>>>Reply-To: nv-l@lists.us.ibm.com
>>>>>
>>>>>
>>>>>Francois is probably right that increasing the application queue size
>>>>>
>>>>>
>>>will
>>>
>>>
>>>>>help resolve your problem, but you should be aware of the performance
>>>>>implications of what you are doing. The reason that ovactiond is
losing
>>>>>contact with trapd is that he cannot execute whatever it is that you
>>>>>
>>>>>
>>are
>>
>>
>>>>>having him execute fast enough to keep up. So his trap queue backs
up
>>>>>inside trapd and then trapd closes it when it gets full. trapd can
>>>>>
>>>>>
>>>>handle
>>>>
>>>>
>>>>>receiving 10 traps a second and passing them on, but ovactiond cannot
>>>>>
>>>>>
>>>take
>>>
>>>
>>>>>action on every one at that rate. So making the queue size bigger
will
>>>>>probably allow ovactiond to stay connected, but he will fall behind.
>>>>>
>>>>>
>>>The
>>>
>>>
>>>>>only way he can catch up is if the trap rate to him slows down
>>>>>
>>>>>
>>>eventually,
>>>
>>>
>>>>>or if he doesn't wait for the actions you ask him to execute to
complete.
>>>>>By default they are serialized. But you can have him just spawn them
>>>>>
>>>>>
>>>as
>>>
>>>
>>>>>fast as he can by setting the wait time (-w) to zero.
>>>>>See the man page on ovactiond.
>>>>>
>>>>>The entire idea behind trap processing is that it should be "bursty",
>>>>>
>>>>>
>>>that
>>>
>>>
>>>>>is, that there should be slow periods as well as fast ones. If there
>>>>>aren't any slow periods, then your daemons are likely to fall behind,
>>>>>depending on how much work you have them do. I don't have any
>>>>>benchmarks to share with you, so you are going to have to watch your
>>>>>
>>>>>
>>>>system
>>>>
>>>>
>>>>>for yourself.
>>>>>
>>>>>James Shanks
>>>>>Level 3 Support for Tivoli NetView for UNIX and Windows
>>>>>Tivoli Software / IBM Software Group
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>> Francois Le Hir
>>>>>
>>>>>
>>>>> <flehir@ca.ibm.co
>>>>>
>>>>>
>>>>> m>
>>>>>
>>>>>
>>>>To
>>>>
>>>>
>>>>> Sent by: nv-l@lists.us.ibm.com
>>>>>
>>>>>
>>>>> owner-nv-l@lists.
>>>>>
>>>>>
>>>>cc
>>>>
>>>>
>>>>> us.ibm.com
>>>>>
>>>>>
>>>>>
>>>>>
>>>Subject
>>>
>>>
>>>>> Re: [nv-l] ovactiond problem
>>>>>
>>>>>
>>>>> 03/08/2006 08:18
>>>>>
>>>>>
>>>>> AM
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>> Please respond to
>>>>>
>>>>>
>>>>> nv-l@lists.us.ibm
>>>>>
>>>>>
>>>>> .com
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>you can increase the value of "Set Trapd connected applications queue
>>>>>
>>>>>
>>>>size"
>>>>
>>>>
>>>>>in the trapd configuration (smitty nv6000 or serversetup). I don't
>>>>>
>>>>>
>>>>remember
>>>>
>>>>
>>>>>the default value but mine is now set to 25000 (which is probably much
>>>>>
>>>>>
>>>>more
>>>>
>>>>
>>>>>than the default).
>>>>>
>>>>>Salutations, / Regards,
>>>>>
>>>>>Francois Le Hir
>>>>>Network Projects & Consulting Services
>>>>>IBM Global Services
>>>>>
>>>>>
>>>>>
>>>>>
>>>>> "Gerardo Ruiz
>>>>> Garcia"
>>>>> <gerardo_ruiz@ini
>>>>>
>>>>>
>>>>To
>>>>
>>>>
>>>>> cia.es> nv-l@lists.us.ibm.com
>>>>> Sent by:
>>>>>
>>>>>
>>>>cc
>>>>
>>>>
>>>>> owner-nv-l@lists.
>>>>> us.ibm.com
>>>>>
>>>>>
>>>Subject
>>>
>>>
>>>>> [nv-l] ovactiond problem
>>>>>
>>>>> 03/08/2006 04:34
>>>>> AM
>>>>>
>>>>>
>>>>> Please respond to
>>>>> nv-l@lists.us.ibm
>>>>> .com
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>Hi list:
>>>>>In our Netview design it is executed a script with several traps are
>>>>>received,
>>>>>in trapd configuracion.
>>>>>As the rate of traps is 10 per second the ovactiond has problems, with
>>>>>
>>>>>
>>>>the
>>>>
>>>>
>>>>>following message in ovactiond.log:
>>>>>
>>>>>03/06/06 10:00:33 ovactiond lost contact with trapd.
>>>>>03/06/06 10:03:40 ovactiond lost contact with trapd.
>>>>>03/06/06 10:14:46 ovactiond lost contact with trapd.
>>>>>03/06/06 10:29:16 ovactiond lost contact with trapd.
>>>>>03/06/06 10:31:14 ovactiond lost contact with trapd.
>>>>>
>>>>>How can I improbe behaviour of ovactiond.
>>>>>trapd is configured with default settings.
>>>>>Netview 7.1.4 FP03 AIX5.2 ML-6 .
>>>>>
>>>>>Any comments wil be appreciated.
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>¿Quieres sacar el máximo a tu conexión Tiscali?
>>>>>
>>>>>Toda la información sobre como configurar tu conexión
>>>>>en nuestra sección de Ayuda.
>>>>>http://ayuda.tiscali.es/ayuda
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>¿Quieres sacar el máximo a tu conexión Tiscali?
>>>>
>>>>Toda la información sobre como configurar tu conexión
>>>>en nuestra sección de Ayuda.
>>>>http://ayuda.tiscali.es/ayuda
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>¿Quieres sacar el máximo a tu conexión Tiscali?
>>>
>>>Toda la información sobre como configurar tu conexión
>>>en nuestra sección de Ayuda.
>>>http://ayuda.tiscali.es/ayuda
>>>
>>>
>>>
>>>
>>>
>>>
>>>
>>>
>>>
>>
>>
>>¿Quieres sacar el máximo a tu conexión Tiscali?
>>
>>Toda la información sobre como configurar tu conexión
>>en nuestra sección de Ayuda.
>>http://ayuda.tiscali.es/ayuda
>>
>>
>>
>>
>>
>>
>>
>
>--
>Tivoli Certified Consultant & Instructor
>Skills 1st Limited, 2 Cedar Chase, Taplow, Bucks, SL6 0EU, UK
>Tel: +44 (0)1628 782565
>Copyright (c) 2006 Jane Curry <jane.curry@skills-1st.co.uk>. All rights
>reserved.
>
>
¿Quieres sacar el máximo a tu conexión Tiscali?
Toda la información sobre como configurar tu conexión
en nuestra sección de Ayuda.
http://ayuda.tiscali.es/ayuda
--
No virus found in this incoming message.
Checked by AVG Free Edition.
Version: 7.1.375 / Virus Database: 268.2.2/280 - Release Date: 3/13/2006
--
No virus found in this outgoing message.
Checked by AVG Free Edition.
Version: 7.1.385 / Virus Database: 268.2.3/281 - Release Date: 3/14/2006
|