In message <[email protected]>,
Tim Peiffer writes:
>My NMS is doing some level of path analysis and therefore root cause and
>is issuing a stack of events, one for each impacted item, by the same
>root cause. I am interested in collapsing the several hundred devices
>into a single event, so that I can attach all of the impacted items to
>the same ticket. The stack of events usually take less than 60 seconds
>to complete. In the example below, I would like to change the 100+
>events into one - Node down: 172.25.1.177 Root cause impact:
>10.20.15.44, 10.20.15.46, ...., 192.168.210.254. I would like some
>help with the ruleset(s) needed. I understand that I can have a context
>lifetime and use the context as an event store. The report function can
>dump the event store before the end of the context lifetime, but I don't
>know how to use the report function to return a single string.
A single LONG string that is.
Collapsing the report is probably best done in a shell
script that the report action calls. But...
Events:
>08/10/2010 09:08:24 000009 INFO: (LockableDownStreamIpHash.cpp)Root
>cause of 10.20.15.44 changing availability to COND 1 is 172.25.1.177
>08/10/2010 09:08:24 000009 INFO: (LockableDownStreamIpHash.cpp)Root
>cause of 10.20.15.46 changing availability to COND 1 is 172.25.1.177
>08/10/2010 09:08:24 000009 INFO: (LockableDownStreamIpHash.cpp)Root
>cause of 10.20.80.252 changing availability to COND 1 is 172.25.1.177
What I would try to get to make the report function easier is to
string two single commands together.
One that recognizes the root cause and sets up the root_cause_172.25.1.177
context, and one that fires if the context exists and gathers the ip address
that are downstream. That way your context would have:
Node down: 172.25.1.177 Root cause impact:
10.20.15.44
10.20.15.46
10.20.80.252
...
(note the leading space on lines 2 onward) and a report action like:
report root_cause_172.25.1.177 tr '\n' ',' | submit
would replace newlines in the input with a comma, and I have prepended
a space to the downstream addresses.
Node down: 172.25.1.177 Root cause impact:, 10.20.15.44, 10.20.15.46,
10.20.80.252, ...,
Perl could be used for a nicer output (the impact:, is annoying 8-)).
A google search for 'sed replace newline' might turn up some
alternatives too.
--
-- rouilj
John Rouillard
===========================================================================
My employers don't acknowledge my existence much less my opinions.
------------------------------------------------------------------------------
This SF.net email is sponsored by
Make an app they can't live without
Enter the BlackBerry Developer Challenge
http://p.sf.net/sfu/RIM-dev2dev
_______________________________________________
Simple-evcorr-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
