Thanks for the help folks. I kind of figured that I was going to have to go the route that Cliff suggested. Old school is going to have be the way for now. I 'm still on 9.1 sp1 and the ECE is still buggy in this rev.
________________________________ From: HUNGERFORD, CLIFF [AG/1000] [mailto:[email protected]] Sent: Tuesday, July 13, 2010 1:58 PM To: spectrum Subject: RE: [spectrum] HPOV messages into Spectrum I assume you'll want to use the "Subject" or "Event Text" variables for the different types and severities. You can use standard event rules to parse these variables for text strings (i.e., 'Disk,' 'cpu,' 'memory,' etc.), and within the event rule create a new event for each category. This would yield a new event code for each type, for which you could also create a separate EVFormat file so that they show up as different Alarm Types in OneClick. If you need to further delineate among the categories for different severities, you can use event rules in the same fashion. Let's assume your EventDisp file looks like this for the OV traps: 0xfff00000 E 30 A 3,0xfff00000, U Your first rule can be to look for the different "scope" or type of alarm (CPU, Memory, etc).. I'll assume this is contained in the EventText, Variable 19: 0xfff00000 R Aprisma.EventCondition,\ "regexp({ v 19 } , { S \"cpu\" })", "0xfff00001 -:-",\ "regexp({ v 19 } , { S \"memory\" })", "0xfff00002 -:-",\ "regexp({ v 19 } , { S \"disk\" })", "0xfff00003 -:-",\ "default", "0xfff00004 -:-" You then set up your event handling for each of the new events you've just created. Let's say that within the "cpu" subset, there are three traps generated, for 75 percent, 85 percent, and 95 percent utilized, but you only want to see a red alarm for the 95%: 0xfff00001 R Aprisma.EventCondition,\ "regexp({ v 19 } , { S \"95 percent\" })", "0xfff00005 -:-",\ "default", "0xfff00006 -:-" 0xfff00005 E 30 A 3,0xfff00005, U 0xfff00006 E 50 Of course, the bulk of the work will be in determining which traps OV will send in the first place, then creating the EventDisp to handle each of the alarm types. You would also still need to create EvFormat files and ProbCause files for each of the traps for which you want to generate an alarm. It would be best to limit the traps that OV sends to only those you care about, to limit the amount of processing required to move the trap through all of the rules (not to mention the work in building the rules to begin with). This is the "old-school" way of doing it (up to 8.1), but is still very effective. There may be a better way with the newer versions of Spectrum. Hope this helps! Regards, Cliff From: Murtey, Patrick [mailto:[email protected]] Sent: Tuesday, July 13, 2010 1:16 PM To: spectrum Subject: [spectrum] HPOV messages into Spectrum Hi All, We are looking into directing traps to Spectrum from an OpenView installation. However after importing the trap mib there is only one event id with one severity, associated with all the incoming messages( cpu, disk, Memory, Events, etc). Has anyone else already had experience with this? What would be the most efficient way to handle these messages in order to get separation of types and severities? The OVNMEvents_NNM.mib when imported into Spectrum : AlertMap # ovnmMessage AdapterVersion 1.3.6.1.4.1.11.779.6.5 0xfff00000 1.3.6.1.4.1.11.779.1(1,0)\ # ToolID 1.3.6.1.4.1.11.779.2(2,0)\ # Severity 1.3.6.1.4.1.11.779.3(3,0)\ # Application 1.3.6.1.4.1.11.779.4(4,0)\ # Object 1.3.6.1.4.1.11.779.5(5,0)\ # NodeName 1.3.6.1.4.1.11.779.6(6,0)\ # Manager 1.3.6.1.4.1.11.779.7(7,0)\ # Subject 1.3.6.1.4.1.11.779.8(8,0)\ # SSID 1.3.6.1.4.1.11.779.9(9,0)\ # Customer 1.3.6.1.4.1.11.779.10(10,0)\ # Location 1.3.6.1.4.1.11.779.11(11,0)\ # Layer 1.3.6.1.4.1.11.779.12(12,0)\ # SubSysNum 1.3.6.1.4.1.11.779.13(13,0)\ # EventNum 1.3.6.1.4.1.11.779.14(14,0)\ # Service 1.3.6.1.4.1.11.779.15(15,0)\ # EmsGenTime 1.3.6.1.4.1.11.779.16(16,0)\ # EmsLogTime 1.3.6.1.4.1.11.779.17(17,0)\ # ReceivedTime 1.3.6.1.4.1.11.779.18(18,0)\ # EventText 1.3.6.1.4.1.11.779.19(19,0) EventDisp 0xfff00000 E 20 A 1,0xfff00000 Thanks Patrick Murtey Network and Systems Management Manager MGM RESORTS Information Technology [email protected] * --To unsubscribe from spectrum, send email to [email protected] with the body: unsubscribe spectrum [email protected] This e-mail message may contain privileged and/or confidential information, and is intended to be received only by persons entitled to receive such information. If you have received this e-mail in error, please notify the sender immediately. Please delete it and all attachments from any servers, hard drives or any other media. Other use of this e-mail by you is strictly prohibited. All e-mails and attachments sent and received are subject to monitoring, reading and archival by Monsanto, including its subsidiaries. The recipient of this e-mail is solely responsible for checking for the presence of "Viruses" or other "Malware". Monsanto, along with its subsidiaries, accepts no liability for any damage caused by any such code transmitted by or accompanying this e-mail or any attachment. * --To unsubscribe from spectrum, send email to [email protected] with the body: unsubscribe spectrum [email protected] --- To unsubscribe from spectrum, send email to [email protected] with the body: unsubscribe spectrum [email protected]
