I assume you'll want to use the "Subject" or "Event Text" variables for
the different types and severities.
You can use standard event rules to parse these variables for text
strings (i.e., 'Disk,' 'cpu,' 'memory,' etc.), and within the event rule
create a new event for each category. This would yield a new event code
for each type, for which you could also create a separate EVFormat file
so that they show up as different Alarm Types in OneClick. If you need
to further delineate among the categories for different severities, you
can use event rules in the same fashion.
Let's assume your EventDisp file looks like this for the OV traps:
0xfff00000 E 30 A 3,0xfff00000, U
Your first rule can be to look for the different "scope" or type of
alarm (CPU, Memory, etc).. I'll assume this is contained in the
EventText, Variable 19:
0xfff00000 R Aprisma.EventCondition,\
"regexp({ v 19 } , { S
\"cpu\" })", "0xfff00001 -:-",\
"regexp({ v 19 } , { S
\"memory\" })", "0xfff00002 -:-",\
"regexp({ v 19 } , { S
\"disk\" })", "0xfff00003 -:-",\
"default", "0xfff00004
-:-"
You then set up your event handling for each of the new events you've
just created. Let's say that within the "cpu" subset, there are three
traps generated, for 75 percent, 85 percent, and 95 percent utilized,
but you only want to see a red alarm for the 95%:
0xfff00001 R Aprisma.EventCondition,\
"regexp({ v 19 } , { S \"95 percent\" })", "0xfff00005 -:-",\
"default", "0xfff00006 -:-"
0xfff00005 E 30 A 3,0xfff00005, U
0xfff00006 E 50
Of course, the bulk of the work will be in determining which traps OV
will send in the first place, then creating the EventDisp to handle each
of the alarm types.
You would also still need to create EvFormat files and ProbCause files
for each of the traps for which you want to generate an alarm.
It would be best to limit the traps that OV sends to only those you care
about, to limit the amount of processing required to move the trap
through all of the rules (not to mention the work in building the rules
to begin with).
This is the "old-school" way of doing it (up to 8.1), but is still very
effective. There may be a better way with the newer versions of
Spectrum.
Hope this helps!
Regards,
Cliff
From: Murtey, Patrick [mailto:[email protected]]
Sent: Tuesday, July 13, 2010 1:16 PM
To: spectrum
Subject: [spectrum] HPOV messages into Spectrum
Hi All,
We are looking into directing traps to Spectrum from an OpenView
installation. However after importing the trap mib there is only one
event id with one severity, associated
with all the incoming messages( cpu, disk, Memory, Events, etc). Has
anyone else already had experience with this? What would be the most
efficient way to handle these
messages in order to get separation of types and severities?
The OVNMEvents_NNM.mib when imported into Spectrum :
AlertMap
# ovnmMessage AdapterVersion
1.3.6.1.4.1.11.779.6.5 0xfff00000 1.3.6.1.4.1.11.779.1(1,0)\
# ToolID
1.3.6.1.4.1.11.779.2(2,0)\
# Severity
1.3.6.1.4.1.11.779.3(3,0)\
# Application
1.3.6.1.4.1.11.779.4(4,0)\
# Object
1.3.6.1.4.1.11.779.5(5,0)\
# NodeName
1.3.6.1.4.1.11.779.6(6,0)\
# Manager
1.3.6.1.4.1.11.779.7(7,0)\
# Subject
1.3.6.1.4.1.11.779.8(8,0)\
# SSID
1.3.6.1.4.1.11.779.9(9,0)\
# Customer
1.3.6.1.4.1.11.779.10(10,0)\
# Location
1.3.6.1.4.1.11.779.11(11,0)\
# Layer
1.3.6.1.4.1.11.779.12(12,0)\
# SubSysNum
1.3.6.1.4.1.11.779.13(13,0)\
# EventNum
1.3.6.1.4.1.11.779.14(14,0)\
# Service
1.3.6.1.4.1.11.779.15(15,0)\
# EmsGenTime
1.3.6.1.4.1.11.779.16(16,0)\
# EmsLogTime
1.3.6.1.4.1.11.779.17(17,0)\
# ReceivedTime
1.3.6.1.4.1.11.779.18(18,0)\
# EventText
1.3.6.1.4.1.11.779.19(19,0)
EventDisp
0xfff00000 E 20 A 1,0xfff00000
Thanks
Patrick Murtey
Network and Systems Management Manager
MGM RESORTS Information Technology
[email protected]
* --To unsubscribe from spectrum, send email to [email protected]
with the body: unsubscribe spectrum [email protected]
---------------------------------------------------------------------------------------------------------
This e-mail message may contain privileged and/or confidential information, and
is intended to be received only by persons entitled to receive such
information. If you have received this e-mail in error, please notify the
sender immediately. Please delete it and all attachments from any servers, hard
drives or any other media. Other use of this e-mail by you is strictly
prohibited.
All e-mails and attachments sent and received are subject to monitoring,
reading and archival by Monsanto, including its subsidiaries. The recipient of
this e-mail is solely responsible for checking for the presence of "Viruses" or
other "Malware". Monsanto, along with its subsidiaries, accepts no liability
for any damage caused by any such code transmitted by or accompanying this
e-mail or any attachment.
---------------------------------------------------------------------------------------------------------
---
To unsubscribe from spectrum, send email to [email protected] with the body:
unsubscribe spectrum [email protected]
