Mabel,
I was intrigued by your post. I have done some "interesting" things
with rulesets and I think I have a solution for you. I tested this on
my system and it does work.
Modify your forwardall.rs -or- create a new ruleset and apply it to
specific users events display.
test.rs:
............/->TS->IA1->OR1->\
Event Stream-->TS->IA2------>Forward
............\->TS->IA3->OR2->/
TS=Trap Setting, configure your trap here (all three are the same trap)
IA1=Inline Action (row-1):echo $NV_ATTR2 | grep -E "Dilbert", Wait=1,
Equal To, Exit=0
IA2=Inline Action {row-2):echo $NV_ATTR2 | grep -E
"Dilbert|Larry|Moe|Curly", Wait=1, Not Equal To, Exit=0
IA3=Inline Action (row-3):echo $NV_ATTR2 | grep -E "Larry|Moe|Curly",
Wait=1, Equal To, Exit=0
OR1=Override (row-1):Status=*no override*, Severity=Minor
OR2=Override (row-2):Status=*no override*, Severity=Major
Event Stream passes to three identical Trap Settings.
Trap Settings passes to Three unique Inline Actions.
Inline Action in row 1 Looks for Dilbert in token-2 and passes it to
Override Sev=Minor, then to Forward
Inline Action in row 2 Looks for Dilbert, Larry, Moe, Curly in token-2
and blocks only these and passes everything else to Forward
Inline Action in row 3 Looks for Larry, Moe, Curly in token-2 and passes
it to Override Sev=Major, then to Forward
I tested this with the NetView 58916866 Interface Up trap.
My Main Events Display workspace displayed a GREEN test message every
time as expected.
My TEST events Display workspace displayed a WHITE test message when the
second token was Dilbert, an ORANGE test message when the second token
was Curly, and a GREEN test message when the second token was not
Dilbert, Larry, Moe or Curly.
I will email you the ruleset file separately.
Hope this helps.
Best Regards,
Don Davis
-----Original Message-----
From: nv-l-bounces@lists.ca.ibm.com
[mailto:nv-l-bounces@lists.ca.ibm.com] On Behalf Of James Shanks
Sent: Tuesday, June 03, 2008 10:42 AM
To: Tivoli NetView Discussions
Subject: Re: [NV-L] Sort an event by message field
Basically, there is no easy way. Your options are quite limited here.
Trapd differentiates traps based on specific id, and sending nodes, not
by varbind contents. You only get one format per specific id and list
of nodes sending the trap. The only way to do something like you propose
that I can see requires quite a bit of user programming.
You'd have to create a ruleset which intercepts this trap and issues
it's own instead, as a script from an action node, using snmptrap. The
script would use a different specific trap number based upon the value
of varbind $2. You would then configure trapd.conf to use different
formats and different severities based on these new specific ids, while
at the same time suppressing the original trap by setting it to "Don't
Log or Display (Ignore). Then you would have to run this ruleset in the
background by editing /usr/OV/conf/ESE.automation and adding it there.
If you like, you can open a problem to IBM support and ask the Level 2
folks to help you do that. It's pretty daunting if you haven't done
anything like it before.
James Shanks
Level 3 Support for Tivoli NetView for UNIX and Windows Network
Availability Management Network Management - Development Tivoli
Software, IBM Corp
_______________________________________________
NV-L mailing list
NV-L@lists.ca.ibm.com
Unsubscribe:NV-L-leave@lists.ca.ibm.com
http://lists.ca.ibm.com/mailman/listinfo/nv-l (Browser access limited to
internal IBM'ers only)
------------------------------------------------------------------------------
Call 1.888.FC DIRECT (1.888.323.4732) or visit us on the web at
firstcitizens.com
today to take advantage of our great products and services.
This electronic mail and any files transmitted with it are confidential and are
intended solely for the use
of individual or entity to whom they are addressed. If you are not the intended
recipient or the person
responsible for delivering the electronic mail to the intended recipient, be
advised that if you have received
this electronic mail in error and that any use, dissemination, forwarding,
printing, or copying of this electronic
mail is strictly prohibited. If you have received this electronic mail in
error, please immediately notify the
sender by return mail.
--------------------
First Citizens Bank - Helping our customers achieve a lifetime of success.
Visit us on the web at firstcitizens.com - Member FDIC
==============================================================================
06/03/08, 14:52:39
_______________________________________________
NV-L mailing list
NV-L@lists.ca.ibm.com
Unsubscribe:NV-L-leave@lists.ca.ibm.com
http://lists.ca.ibm.com/mailman/listinfo/nv-l (Browser access limited to
internal IBM'ers only)
|