Event Management and Best Practices

284 Event Management and Best Practices

The event now displays with Major severity, as shown in Figure 6-37.

Figure 6-37 Node down with escalated (major) severity

Worsening condition escalation

NetView can hold traps for a specified time to see if another event is received. It

can also resolve an event upon receipt of another.

However, it is incapable of reprocessing a trap that has already been processed.

Therefore, there is currently no way for NetView to escalate the severity of a trap

to indicate a worsening condition.

State correlation

The IBM Tivoli Enterprise Console state correlation gateway can handle

escalating or worsening events that pertain only to criteria matching the XML rule

and in the specified time period contained in the rule. This rule, or these rules,

can specify a time period to wait for other events. From there, it can escalate the

severity of the event before it is sent to the IBM Tivoli Enterprise Console event

server (if another event is received that matches this define criteria). This is a one

time only operation.

After the correlated event is sent to the IBM Tivoli Enterprise Console event

server, the rule resets itself, and waits for another event, which matches its

criteria. If the next event, which matches the criteria, represents a worsening

condition, it is treated as a new event, and the correlation in the rule starts over.

Chapter 6. Event management products and best practices 285

We recommend that you use both the state correlation engine on the gateway

and the IBM Tivoli Enterprise Console event server rule engine in conjunction

with each other to ensure proper escalation of worsening conditions.

Escalating events with IBM Tivoli Enterprise Console event

server

The severity of events can be escalated using IBM Tivoli Enterprise Console

rules. This section reviews several rules that are supplied with IBM Tivoli

Enterprise Console and NetView. It explains how they are used to escalate the

severity of events. Plus it describes the predicates that are available in IBM Tivoli

Enterprise Console to code your own escalation rules.

Escalation in netview.rls

The default installation for NetView configures event forwarding, so that all traps

sent to IBM Tivoli Enterprise Console from NetView have a WARNING severity.

The rules in the netview.rls rule set adjust the severity of the events according to

Table 6-9.

Table 6-9 Rules from the netview.rls rule set

Rule Function

router_raise Raises the severity of router down events to CRITICAL.

interface_lower Lowers the severity of interface up events to HARMLESS.

isdn_lower Lowers the severity of ISDN active events to HARMLESS.

snmp_lower Lowers the severity of SNMP collect re-arm events to

HARMLESS.

node_lower Lowers the severity of node up events to HARMLESS.

router_lower Lowers the severity of router up events to HARMLESS.

subnet_lower Lowers the severity of subnet reachable events to

HARMLESS.

interface_added_lower Lowers the severity of interface added events to

HARMLESS.

interface_managed_lower Lowers the severity of interface managed events to

HARMLESS.

node_added_lower Lowers the severity of node added events to HARMLESS.

node_managed_lower Lowers the severity of node managed events to

HARMLESS.