In message <4c0e7171....@umn.edu>,
Tim Peiffer writes:
>[...] coincide with my thinking. I think the difficult part for me will not be 
>SEC config, but rather the interaction with the change control system in 
>terms of entering change control information and extracting it from the 
>tables programatically or via SQL.
> [...]
>7. Need to modify any of the existing ticket methods to account for the 
>new context labeled ‘quiet’.
>
>type=PairWithWindow
>ptype=RegExp
>pattern=Node Unreachable: (\S+)
>desc=Node Unreachable:down message
>context= !quiet:$1 && !reboot:$1
>action=create "reboot:$1" 1200 ; logonly ticket requested %s ;\
>spawn SCTicket \
>-category "DATA SERVICE" \
>-subcategory "data switch" \
>-problemtype "connectivity" \
>-producttype "none" \
>-severity major \
>-title "%s" \
>-text "The host $1 is not responding to polls. Please investigate."
>ptype2=RegExp
>pattern2=Node Reachable: (\S+)
>desc2=Node Reachable:Up message
>action2=delete reboot:$1 ; logonly “Node $1 Reachable – possible bounce”
>window=300

If all your ticket methods are in a single sec rules file, you may be
able to get away with a single rule higher in the stack that simply
captures the node name and looks for the context quiet:$1 to remove
the event from the stream. It may save you from having to update a
bunch of rules.

--
                                -- rouilj
John Rouillard
===========================================================================

------------------------------------------------------------------------------
ThinkGeek and WIRED's GeekDad team up for the Ultimate 
GeekDad Father's Day Giveaway. ONE MASSIVE PRIZE to the 
lucky parental unit.  See the prize list and enter to win: 
http://p.sf.net/sfu/thinkgeek-promo
_______________________________________________
Simple-evcorr-users mailing list
Simple-evcorr-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users

Reply via email to