Just thought I would mention that traps that are set to "log only" in
trapd.conf are still evaluated by all rulesets. As mentioned, Nvserverd
will not see a trap marked this way, but all other nodes will following the
rules of the ruleset... Such that it is possible to forward a log only trap
to TEC from the ruleset that Nvserverd is using with an action/in-line
action and (w)postemsg. Or, you can really confuse yourself by logging what
you think you are forwarding to TEC, which is how I learned this.
Something to keep in mind for performance or, in some cases, practical
reasons.
Regards,
Greg Keetch
IT Specialist (Advisor), Network Services
Network Management Tools Specialist
Information Technology Services Americas (ITSA), Global Services, IBM
Canada
Leslie Clark
<lclark@us.ibm.co
m> To
Sent by: Tivoli NetView Discussions
nv-l-bounces@list <nv-l@lists.ca.ibm.com>
s.ca.ibm.com cc
Subject
11/27/2006 10:12 Re: [nv-l] Splitting up TEC
AM integration by using TEC_ITS and
another ruleset for external
traps in ESE.automation 7.1.4/7.1.5
Please respond to
Tivoli NetView
Discussions
<nv-l@lists.ca.ib
m.com>
Here's what I have done for the external traps:
For each MIB with traps, add to TEC_ITS.rs an Event Attribute cube
specifying the Enterprise, with a Forward.
In the trapd.conf for the traps in that Enterprise, set the ones you do NOT
want to forward to Log Only. Nvserverd will not see those marked Log Only.
This makes for a simple and fast filter on the traps.
In the odd case where you need to filter one of those traps by device, add
an additional Trap Settings for the specific trap, and do an inline action
that greps a flat file.
This externalizes some controls, eg the log only business and the flat file
business so there is less complexity in the ruleset and less disruption of
the flow of events when you want to make changes.
Cordially,
Leslie A. Clark
IT Services Specialist, Network Mgmt
Information Technology Services Americas
IBM Global Services
(248) 552-4968 Voicemail, Fax, Pager
"Van Order, Drew \(US -
Hermitage\)"
<dvanorder@deloitte.com> To
Sent by: "Tivoli NetView Discussions"
nv-l-bounces@lists.ca.ibm.co <nv-l@lists.ca.ibm.com>
m cc
Subject
11/27/2006 11:44 AM [nv-l] Splitting up TEC integration by
using TEC_ITS and another
ruleset for external traps in
Please respond to ESE.automation 7.1.4/7.1.5
Tivoli NetView Discussions
<nv-l@lists.ca.ibm.com>
Anyone doing this successfully? I ask because TEC_ITS.rs is now unwieldy
with both internal and external trap processing. We are also getting
requests to perform additional filtering/processing on external traps prior
to forwarding to TEC. It spooks me to think of doing this all in TEC_ITS. I
thought a solution could be having a ruleset in ESE.automation that handles
all external traps/processing. The forwarding to TEC would be handled by an
Action node that fires a script invoking postemsg, or running postemsg
directly and passing trap variables.
Alas, it appears that none of the TEC slot mappings are passed as variables
to an action node. Nor are they passed to the environment if you run an
automatic action in trapd.conf. I searched the list archives before posting
this, good chance someone has already asked this same question. Too bad
nvserverd can't work with more than one ruleset; that would be the ideal
situation.
Thanks--
Drew Van Order
Information Technology Services
Deloitte Services LP
Tel: +1 615 882 7836
www.deloitte.com
This message (including any attachments) contains confidential information
intended for a specific individual and purpose, and is protected by law.
If you are not the intended recipient, you should delete this message.
Any disclosure, copying, or distribution of this message, or the taking of
any action based on it, is strictly prohibited. [v.E.1]
_______________________________________________
NV-L mailing list
NV-L@lists.ca.ibm.com
Unsubscribe:NV-L-leave@lists.ca.ibm.com
http://lists.ca.ibm.com/mailman/listinfo/nv-l (Browser access limited to
internal IBM'ers only)
_______________________________________________
NV-L mailing list
NV-L@lists.ca.ibm.com
Unsubscribe:NV-L-leave@lists.ca.ibm.com
http://lists.ca.ibm.com/mailman/listinfo/nv-l (Browser access limited to
internal IBM'ers only)
_______________________________________________
NV-L mailing list
NV-L@lists.ca.ibm.com
Unsubscribe:NV-L-leave@lists.ca.ibm.com
http://lists.ca.ibm.com/mailman/listinfo/nv-l (Browser access limited to
internal IBM'ers only)
|