While it is true that NetView started out as a clone of HP OpenView, that
was in 1991. The code was licensed from HP because they refused to port
it to IBM's AIX. But beginning with NetView Version 2 in 1993, the two
products went their separate ways, each adding new features and developing
in the ways they saw fit for their customer base. Now they bear little
resemblance to each other, especially under the covers. It is a serious
mistake to think that just because NetView has "OV" in it's code that you
can administer or deploy it as you would HP OpenView. Furthermore, the
NetView for Windows product originated as a project at Digital Equipment
Corporation, and it is based on NetView Version 3. It debuted as Version 5
in 1998. By then NetView was also available on Solaris and Digital UNIX.
Linux and zLinux were added in Version 7. It was found that much of the
original HP C and C++ code would not transfer to Windows, so the product
you have on Windows today is even farther from HP OpenView. Your best bet
as a NetView administrator is to forget everything you know about OpenView
and start reading the manuals in \usr\ov\books, particularly the User's
Guide.
There is no option to configure trapd on Windows to discard events. Every
one he gets will get stored in the database. Period. The IBM solution for
this is to deploy an MLM (which is easier if you do it on another machine
than the NetView one) and let that machine be your external network trap
receiver. MLM has a trap destination table and a thresholding mechanism
which you can configure to send what traps you like to the NetView box. He
can act as a filter for a trap storm. But at the current time, MLM is
strictly an SNMPv1 agent. If he gets an SNMPv2 trap, it will be discarded
as invalid. So if you have SNMPv2 agents you will have to direct their
traps to NetView, and you will have to configure trapd to handle them. By
default, trapd throws away SNMPv2 traps as invalid also. But the Release
Notes for FixPack 4 explain how to change that.
I would also look at figuring out why you had an authentication failure
trap storm and solving that at the device which caused it, rather than
relying on a filtering mechanism to make you unaware of it. Studies have
shown that trap storms can be very effective denial-of-service mechanisms,
clogging the network bandwidth with pointless messages, and keeping
legitimate traffic from getting through on a timely basis. It is better to
stop these things from reoccurring rather than just trying to mask them.
James Shanks
Level 3 Support for Tivoli NetView for UNIX and Windows
Network Availability Management
Network Management - Development
Tivoli Software, IBM Corp
"SANTA Giovanni"
<Giovanni.SANTA@g
lobalvalue.it> To
Sent by: "Tivoli NetView Discussions"
nv-l-bounces@list <nv-l@lists.ca.ibm.com>
s.ca.ibm.com cc
Subject
08/31/2006 04:47 RE: [NV-L] Event Browser
AM
Please respond to
Tivoli NetView
Discussions
<nv-l@lists.ca.ib
m.com>
Thanks you for clear explanation, I work on HP Openview since years and
I start on Netview only since few months and I learn to use it directly
on field (very hard !).
On OV Event Configurator there is the feature to discard messages, on NV
there is only the log ones; on week-end after the NV installation an
events storm of authentication fail traps occurred; the number of
messages are more than tenth of thousand. The configuration of trapd was
the default.
The question is: is there some mechanism to block massive events? I have
seen Netcool/Inpact ...
Thanks for your patients
Giovanni
-----Original Message-----
From: nv-l-bounces@lists.ca.ibm.com
[mailto:nv-l-bounces@lists.ca.ibm.com] On Behalf Of James Shanks
Sent: Wednesday, August 30, 2006 3:15 PM
To: Tivoli NetView Discussions
Subject: RE: [NV-L] Event Browser
Once again, you have a serious misunderstanding of how the NetView for
Windows product works.
An ruleset, a .rs file, functions only as a viewing filter. It does
not remove any events from the database, in fact, it usually creates
more events.
I am not certain how you are getting duplicate events nor even what you
mean by that term. Are they external events sent by an outside source,
such as a router which might be sending the same event every second
until the problem it has is fixed? The way to deal with that is to
change the router configuration so that it is not so verbose. Or you
can install an MLM and use it as trap filter, forwarding only those
events you wish to see
NetView by itself will not create duplicate events, though if you have
rulesets running in the background in nvcord, then near-duplicate
events, called correlation events, will be generated. The way to deal
with this is to use the ruleset you are running as a viewing filter
rather than use the "All Events" default. Please read the file
\usr\ov\doc\Rulesets_on_Windows.readme to get a better understanding of
how ruleset work on Windows and how you might employ the samples.
Perhaps you can modify the threeinfive.rs file to do what you want. But
you still must specify that as your viewing filter in the Event Browser
for it to work. I recommend that if you start experimenting in this way
that you open more than one Event Browser, having one set to "All
Events' and the other to your customer filter, so that you can see just
what's being included, and excluded, in your custom view.
James Shanks
Level 3 Support for Tivoli NetView for UNIX and Windows Network
Availability Management Network Management - Development Tivoli
Software, IBM Corp
"SANTA Giovanni"
<Giovanni.SANTA@g
lobalvalue.it>
To
Sent by: "Tivoli NetView Discussions"
nv-l-bounces@list <nv-l@lists.ca.ibm.com>
s.ca.ibm.com
cc
Subject
08/30/2006 04:40 RE: [NV-L] Event Browser
AM
Please respond to
Tivoli NetView
Discussions
<nv-l@lists.ca.ib
m.com>
Thanks a lot,
The platform is Windows, we have see a lot of messages, over 5000, more
duplicated. I need remove the duplicates messages with event correlato.
Have you an example of .rs file?
Thanks in advance
Giovanni
-----Original Message-----
From: nv-l-bounces@lists.ca.ibm.com
[mailto:nv-l-bounces@lists.ca.ibm.com] On Behalf Of James Shanks
Sent: Tuesday, August 29, 2006 8:32 PM
To: Tivoli NetView Discussions
Subject: Re: [NV-L] Event Browser
What you have is not a strange problem but a serious misunderstanding of
how this code works.
You said "standalone" so I am assuming that this is a Windows
installation.
The tdwdaemon.properties have nothing whatever to do with what you see
in the Event Browser. They have to do with how the optional tdwdaemon
stores
data into the Tivoli Data Warehouse. Are you running this daemon? The
Event Browser is unaware of the tdwdaemon or the data he sends to DB2.
The Event Browser gets it's data directly from trapd, the Trap daemon,
who writes it to the local NetView database,
The data you see in the Event Browser is from the local event database,
either Jet, the kind you can read outside NetView with MS Access or SQL
Server. To use SQL Server you would have had to install it before you
installed NetView. But no matter the underlying database, by default,
trapd stores 5000 events in chronological order in that database, and
once full it purges every 1000. This is controlled in Server Setup by
options on the Trap Daemon. What you see in the Event Browser is a
subset of what
is stored in that database. The number of records retrieved and the
refresh rate is controlled by the Options --> Settings pull down in the
Event Browser
James Shanks
Level 3 Support for Tivoli NetView for UNIX and Windows Network
Availability Management Network Management - Development Tivoli
Software, IBM Corp
"SANTA Giovanni"
<Giovanni.SANTA@g
lobalvalue.it>
To
Sent by: <NV-L@lists.ca.ibm.com>
nv-l-bounces@list
cc
s.ca.ibm.com
Subject
[NV-L] Event Browser
08/29/2006 12:10
PM
Please respond to
Tivoli NetView
Discussions
<nv-l@lists.ca.ib
m.com>
Hi all
I have installed an standalone Netview 7.1.4 FP4 and I have a strange
problem: I see on Event Browser ony a current day events but in
tdwdaemon.properties the value is 90!
I have tried with filter but the result is the same.
Another question: I need to remove/add events on database, how I do?
Thanks In Advance
Kind Regards
Giovanni
_______________________________________________
NV-L mailing list
NV-L@lists.ca.ibm.com
Unsubscribe:NV-L-leave@lists.ca.ibm.com
http://lists.ca.ibm.com/mailman/listinfo/nv-l (Browser access limited to
internal IBM'ers only)
_______________________________________________
NV-L mailing list
NV-L@lists.ca.ibm.com
Unsubscribe:NV-L-leave@lists.ca.ibm.com
http://lists.ca.ibm.com/mailman/listinfo/nv-l (Browser access limited to
internal IBM'ers only)
_______________________________________________
NV-L mailing list
NV-L@lists.ca.ibm.com
Unsubscribe:NV-L-leave@lists.ca.ibm.com
http://lists.ca.ibm.com/mailman/listinfo/nv-l (Browser access limited to
internal IBM'ers only)
_______________________________________________
NV-L mailing list
NV-L@lists.ca.ibm.com
Unsubscribe:NV-L-leave@lists.ca.ibm.com
http://lists.ca.ibm.com/mailman/listinfo/nv-l (Browser access limited to
internal IBM'ers only)
_______________________________________________
NV-L mailing list
NV-L@lists.ca.ibm.com
Unsubscribe:NV-L-leave@lists.ca.ibm.com
http://lists.ca.ibm.com/mailman/listinfo/nv-l (Browser access limited to
internal IBM'ers only)
_______________________________________________
NV-L mailing list
NV-L@lists.ca.ibm.com
Unsubscribe:NV-L-leave@lists.ca.ibm.com
http://lists.ca.ibm.com/mailman/listinfo/nv-l (Browser access limited to
internal IBM'ers only)
|