O'Reilly logo

Event Management and Best Practices by Michael Wallace, Guilherme Pereira, Jacqueline Meckwood, Peter Glasmacher, Tony Bhe

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

284 Event Management and Best Practices
The event now displays with Major severity, as shown in Figure 6-37.
Figure 6-37 Node down with escalated (major) severity
Worsening condition escalation
NetView can hold traps for a specified time to see if another event is received. It
can also resolve an event upon receipt of another.
However, it is incapable of reprocessing a trap that has already been processed.
Therefore, there is currently no way for NetView to escalate the severity of a trap
to indicate a worsening condition.
State correlation
The IBM Tivoli Enterprise Console state correlation gateway can handle
escalating or worsening events that pertain only to criteria matching the XML rule
and in the specified time period contained in the rule. This rule, or these rules,
can specify a time period to wait for other events. From there, it can escalate the
severity of the event before it is sent to the IBM Tivoli Enterprise Console event
server (if another event is received that matches this define criteria). This is a one
time only operation.
After the correlated event is sent to the IBM Tivoli Enterprise Console event
server, the rule resets itself, and waits for another event, which matches its
criteria. If the next event, which matches the criteria, represents a worsening
condition, it is treated as a new event, and the correlation in the rule starts over.
Chapter 6. Event management products and best practices 285
We recommend that you use both the state correlation engine on the gateway
and the IBM Tivoli Enterprise Console event server rule engine in conjunction
with each other to ensure proper escalation of worsening conditions.
Escalating events with IBM Tivoli Enterprise Console event
server
The severity of events can be escalated using IBM Tivoli Enterprise Console
rules. This section reviews several rules that are supplied with IBM Tivoli
Enterprise Console and NetView. It explains how they are used to escalate the
severity of events. Plus it describes the predicates that are available in IBM Tivoli
Enterprise Console to code your own escalation rules.
Escalation in netview.rls
The default installation for NetView configures event forwarding, so that all traps
sent to IBM Tivoli Enterprise Console from NetView have a WARNING severity.
The rules in the netview.rls rule set adjust the severity of the events according to
Table 6-9.
Table 6-9 Rules from the netview.rls rule set
Rule Function
router_raise Raises the severity of router down events to CRITICAL.
interface_lower Lowers the severity of interface up events to HARMLESS.
isdn_lower Lowers the severity of ISDN active events to HARMLESS.
snmp_lower Lowers the severity of SNMP collect re-arm events to
HARMLESS.
node_lower Lowers the severity of node up events to HARMLESS.
router_lower Lowers the severity of router up events to HARMLESS.
subnet_lower Lowers the severity of subnet reachable events to
HARMLESS.
interface_added_lower Lowers the severity of interface added events to
HARMLESS.
interface_managed_lower Lowers the severity of interface managed events to
HARMLESS.
node_added_lower Lowers the severity of node added events to HARMLESS.
node_managed_lower Lowers the severity of node managed events to
HARMLESS.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required