Fred, If your 8.1 patch level supports Event Procedures (which is a 9.0 feature that was back-ported in early 2009, check with CA for which patch level of 8.1 includes it), then you should be able to use an Event Procedure to extract the source IP from that event (it's either 0x10801 or 0x10802, I forget) and generate a new Custom Event that raises an alarm (on the VNM). This will reduce thousands of events to a small number of alarms identifying the culprit IP(s).
I've been meaning to write one of these Event Procedures for a while, but I have not stopped to do so yet. HTH, --Mark S ________________________________ Mark Serencha - Inforonics LLC - (m) +1-781-439-0519 - (w) +1-978-698-7418 - [email protected] <mailto:[email protected]> From: Sean Carnes [mailto:[email protected]] Sent: Thursday, June 10, 2010 3:30 PM To: spectrum Subject: Re: [spectrum] Report Manager - Event Report - 8.1 The way we worked around report manager not being able to export those large reports was to run the queries directly against the mysql instance, either using mysql on the command line or using one of the many gui tools available. It is not as nice as using report manager, since you have to join a bunch of tables most of the time to get the model handles right and other things, but www.dachsug.ch <http://www.dachsug.ch> can help a lot with that since they have part of the srm schema on their site. If you want I can send along some of the queries we use to determine alarm counts and event counts for different devices and other types of queries. Even with the schema from www.dachsug.ch it took some time to write the queries since it is not very well documented. We are still on 8.1.20 right now, we have our 9.1.x environment u/r and are just waiting on migrating all of our devices to send traps to EI/trapXploder. They have finally upgraded their mysql version from 4.1.x to a 5.0.x release I believe. From what we see it is a huge performance increase, but if you log too many events it can still slow down significantly just like any database would. Let me know if you need those queries. Regards, Sean Sean Carnes Cablevision Systems Corp. Network Management Systems & Metrics 172*85*77/5167902323/5163905910 >>> F J Rutcho <[email protected]> 06/10/10 2:54 PM >>> All, Yes, we're still on 8.1 (going to 9.1.x soon). Have a question regarding exporting the data from Report Manager Event Report. I ran a report against ONE model. There were only 17 days (2.5 weeks) in the data range. The quantity of events that was output was 450,000 (yes, 450 thousand). I've tried to export the data to examine it, however Report Manager never responds to the Export request. Any ideas short of running 17 reports, one for each day? By the way, the model with all the events is the VNM. And all these events appear to be traps from unknown devices. Thanks for your help. Sincerely, Fred ________________________________ The New Busy is not the too busy. Combine all your e-mail accounts with Hotmail. Get busy. <http://www.windowslive.com/campaign/thenewbusy?tile=multiaccount&ocid=P ID28326::T:WLMTAGL:ON:WL:en-US:WM_HMP:042010_4> * --To unsubscribe from spectrum, send email to [email protected] with the body: unsubscribe spectrum [email protected] * --To unsubscribe from spectrum, send email to [email protected] with the body: unsubscribe spectrum [email protected] -------------------------------------------------------- The information transmitted in this email and any of its attachments is intended only for the person or entity to which it is addressed and may contain information concerning Cablevision and/or its affiliates and subsidiaries that is proprietary, privileged, confidential and/or subject to copyright. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient(s) is prohibited and may be unlawful. If you received this in error, please contact the sender immediately and delete and destroy the communication and all of the attachments you have received and all copies thereof. -------------------------------------------------------- --- To unsubscribe from spectrum, send email to [email protected] with the body: unsubscribe spectrum [email protected]
