In message <4c0e7171....@umn.edu>,
Tim Peiffer writes:
>[...] coincide with my thinking. I think the difficult part for me will not be
>SEC config, but rather the interaction with the change control system in
>terms of entering change control information and extracting it from the
>tables programatically or via SQL.
> [...]
>7. Need to modify any of the existing ticket methods to account for the
>new context labeled quiet.
>
>type=PairWithWindow
>ptype=RegExp
>pattern=Node Unreachable: (\S+)
>desc=Node Unreachable:down message
>context= !quiet:$1 && !reboot:$1
>action=create "reboot:$1" 1200 ; logonly ticket requested %s ;\
>spawn SCTicket \
>-category "DATA SERVICE" \
>-subcategory "data switch" \
>-problemtype "connectivity" \
>-producttype "none" \
>-severity major \
>-title "%s" \
>-text "The host $1 is not responding to polls. Please investigate."
>ptype2=RegExp
>pattern2=Node Reachable: (\S+)
>desc2=Node Reachable:Up message
>action2=delete reboot:$1 ; logonly Node $1 Reachable possible bounce
>window=300
If all your ticket methods are in a single sec rules file, you may be
able to get away with a single rule higher in the stack that simply
captures the node name and looks for the context quiet:$1 to remove
the event from the stream. It may save you from having to update a
bunch of rules.
--
-- rouilj
John Rouillard
===========================================================================
------------------------------------------------------------------------------
ThinkGeek and WIRED's GeekDad team up for the Ultimate
GeekDad Father's Day Giveaway. ONE MASSIVE PRIZE to the
lucky parental unit. See the prize list and enter to win:
http://p.sf.net/sfu/thinkgeek-promo
_______________________________________________
Simple-evcorr-users mailing list
Simple-evcorr-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users