Re: [NV-L] Best method to filter traps from specific IP addresses in ruleset

[Leslie Clark <lclark@us.ibm.com>]

It is good to worry about doing that
from the TEC ruleset. What I have done in the past is an inline action,
which also makes me nervous, that does a grep for the attribute in a flat
file. Then you just administer the file. You will have to mess around with
it to get the logic and return code evaluation right.

Cordially,

Leslie A. Clark
IT Services Specialist, Network Mgmt
Information Technology Services Americas
IBM Global Services
(248) 552-4968 Voicemail, Fax, Pager

"Van Order, Drew \(US - Hermitage\)" <dvanorder@deloitte.com>
Sent by: nv-l-bounces@lists.ca.ibm.com

11/21/2006 12:40 PM

Please respond to
Tivoli NetView Discussions <nv-l@lists.ca.ibm.com>

To	"Tivoli NetView Discussions" <nv-l@lists.ca.ibm.com>
cc
Subject	[NV-L] Best method to filter traps from specific IP addresses in        ruleset

Hi everyone,

Our customer has been receiving Peribit traps for a few weeks. It currently looks like this in the ruleset:

Trap Settings node for Peribit trap Enterprise ID (all traps highlighted) ----> Forward to TEC

Customer has requested that for just one of the traps, we only forward if it comes from 4 IP addresses, otherwise drop. I figure I will deselect this trap from the current Trap Settings node, then add a second Peribit Trap Settings node with just the one trap highlighted. It's after this step that I am wondering what will be most efficient.

I know I can create a SmartSet with just these 4 IP addresses, but understand SmartSet queries in rulesets are very expensive, and I don't want to compromise performance since this is also our TEC_ITS ruleset. Is there a better way to do this w/o Smart Set query? I don't want to create a TEC rule for this, I think it's smarter to do it closest to the trap source.

Thanks!---Drew

Drew Van Order
Information Technology Services
Deloitte Services LP
Tel: +1 615 882 7836
www.deloitte.com

This message (including any attachments) contains confidential information intended for a specific individual and purpose, and is protected by law.  If you are not the intended recipient, you should delete this message.

Any disclosure, copying, or distribution of this message, or the taking of any action based on it, is strictly prohibited. [v.E.1]_______________________________________________
NV-L mailing list
NV-L@lists.ca.ibm.com
Unsubscribe:NV-L-leave@lists.ca.ibm.com
http://lists.ca.ibm.com/mailman/listinfo/nv-l (Browser access limited to internal IBM'ers only)

_______________________________________________
NV-L mailing list
NV-L@lists.ca.ibm.com
Unsubscribe:NV-L-leave@lists.ca.ibm.com
http://lists.ca.ibm.com/mailman/listinfo/nv-l (Browser access limited to 
internal IBM'ers only)