[Search for users] [Overall Top Noters] [List of all Conferences] [Download this site]

Conference azur::mcc

Title:DECmcc user notes file. Does not replace IPMT.
Notice:Use IPMT for problems. Newsletter location in note 6187
Moderator:TAEC::BEROUD
Created:Mon Aug 21 1989
Last Modified:Wed Jun 04 1997
Last Successful Update:Fri Jun 06 1997
Number of topics:6497
Total number of notes:27359

4293.0. "MULTIPLE DOMAIN NOTIFICATION" by ROM01::RENDINA () Mon Dec 21 1992 08:26


Hy guys,

Using DECmcc V1.2.0 BMS on a VAXstation 4000 mod 60 I have meet the following
problem, can you help me?

I have to manage a WAN network containing many phaseIV nodes; these nodes are 
divided into several domains.

For each domain I have created 8 alarm rules about 8 different DECnet events,
using wildcard (occurs(NODE4 * ....))

Well, when an event come from a node4 in the net all the domains notify this
alarm (but only in one of them there is the event's sender).

This problem can be reproduced so:

	MCC>	register node4 AAA synonym AAA
	MCC>	create domain XXX member AAA
	MCC>	create domain XXX rule XXXNODE4 -
		  expression=(occurs(NODE4 * circ * Counters zeroed)),-
		  severity=Warning
		
	MCC>	register node4 BBB synonym BBB
	MCC>	create domain YYY member BBB
	MCC>	create domain YYY rule YYYNODE4 -
		  expression=(occurs(NODE4 * circ * Counters zeroed)),-
		  severity=Warning
		
When i zero the circuit counters of node AAA, i can see one event coming from
node AAA in the NOTIFICATION PM, but also BOTH the alarms in BOTH the domains.

So I have tried to bypass this problem changing the naming structure for the
Node4, so i have used a prefix (DNS directory):

For example:  	register node4 D_XXX.AAA synonym AAA
		create domain XXX member AAA
		create domain XXX rule XXXNODE4 -
		  expression=(occurs(NODE4 D_XXX.* circ * Counters zeroed)),-
		  severity=Warning
		
		register node4 D_YYY.BBB synonym BBB
		create domain YYY member BBB
		create domain YYY rule YYYNODE4 -
		  expression=(occurs(NODE4 D_YYY.* circ * Counters zeroed)),-
		  severity=Warning

(I have also tried specifying the entire name MELONE_NS:.D_XXX.AAA in the
rule's sintax, with the same results)
		
When i zero the circuit counters of node AAA, i can see the event from node AAA
in the NOTIFICATION PM, but the alarm rule don't fire and NO domains notify
the alarm (if I use the entire name D_XXX.AAA instead of D_XXX.* the rule works)


questions
=========

	How can I use correctly the wildcard in the alarm expression?

	In large network, with hundreds of nodes and 9 or 10 events to control
	for each node, i cant create and ENABLE thousands of rules; using
	the wildcard i shoud reduce the time to mantain the database of rules
	and the resources to keep enable these rules.

Many thanks for any help

							cheers, piero rendina
T.RTitleUserPersonal
Name
DateLines
4293.1SPR 44301 (with SNMP *, note 4171.0)ZTOIS1::VISTARenato VISTA, SIS Strasbourg, FranceMon Dec 21 1992 10:279
    
    Piero,
    
    I've met the same problem with OCCURS(snmp * any event) -see 4171.*-
    There is a real problem indeed... An SPR (ICA 44301) has been
    submitted.
    
    Renato
    
4293.2DECmcc V1.3 ????ROM01::RENDINAThu Dec 24 1992 06:1923
Hello Renato,

thanks for your information,

the rule definition expression (occurs("entity" * "event name")) doesn't work,
i have tried it also with an AM developed for TELENET X.25 switch node, i have
found the same problem.

DECmcc doesn't support partial name, like:
	"(occurs(NODE4 D_XXX.* circ * Counters zeroed))"
(infact if you try to do: "MCC> SHOW NODE4 D_XXX.*" you get an error message)
What can we do? I don't know!
		
>
> ... An SPR (ICA 44301) has been submitted. ...
>

Do you think that it has been solved in the version 1.3 ? 

		Bye Bye, and Merry Xmas

								piero
4293.3pb still exists in MCC T1.3.0ZTOIS1::VISTARenato VISTA, SIS Strasbourg, FranceMon Dec 28 1992 09:499
    
    Piero,
    
    Aftering testing MCC T1.3.0 on VMS plaftform, the problem is still
    existing... for SNMP * but also for <any_class> * !!
    
    I'm expecting any opinion via official ECSO/CLD channel.
    
    Renato
4293.4I think the problem was fixed in T1.3.0TRM::KWAKThu Dec 31 1992 15:00101
    
    RE: .3
    
    Are you definitely using T1.3.0 Alarms module on VMS?
    The T1.3.0 Alarms should have fixed the domain filtering problem.
    
    I have run another test today on VMS and observed that the problem does 
    not happen.
    
    
    MCC> sho domain qar_2530 mem *
    Using default ALL IDENTIFIERS
    
    Domain LOCAL_NS:.qar_2530 Member LOCAL_NS:.tornet
    AT 31-DEC-1992 14:49:54 Identifiers
    
    Examination of attributes shows
                                 MemberName = LOCAL_NS:.tornet
    
    Domain LOCAL_NS:.qar_2530 Member LOCAL_NS:.ip.mccts1
    AT 31-DEC-1992 14:49:55 Identifiers
    
    Examination of attributes shows
                                 MemberName = LOCAL_NS:.ip.mccts1
    MCC> sho domain LOCAL_NS:.qar_2530 rule * all attr
    
    Domain LOCAL_NS:.qar_2530 Rule occurs_filter
    AT 31-DEC-1992 14:50:16 All Attributes
    
                                       Name = occurs_filter
                                      State = Enabled
                                   Substate = Running
                    Time of Last Evaluation = 31-DEC-1992 14:45:13.05
                  Result of Last Evaluation = True
                           Current Severity = Warning
                         Creation Timestamp = 31-DEC-1992 14:43:59.48
                           Evaluation Error = 0
                            Evaluation True = 2
                           Evaluation False = 0
                                 Expression = (occurs (snmp * any event))
                                   Severity = Warning
                             Probable Cause = Unknown
    MCC>! NOW I generate An authenticationFailure trap on system ".tornet"
    MCC>! by issuing "MCC> sho snmp tornet sysuptime, by pass = foo"
    MCC>! Note that the password is incorrect.
    
    MCC>
    
    !!!!!!!!!!!!!! Alarm, 31-DEC-1992 14:53:26 !!!!!!!!!!!!!! [1]
    Domain: LOCAL_NS:.qar_2530                            Severity: Warning
    Notification Entity: SNMP LOCAL_NS:.tornet
    Event Source: Domain LOCAL_NS:.qar_2530 Rule occurs_filter
    Event: OSI Rule Fired
    
                                 Event Type = QualityofServiceAlarm
                                 Event Time = 31-DEC-1992 14:53:26.25
                             Probable Cause = Unknown
                            Additional Info = { (
                                   significance = True,
                                    information = "The last event detected:
    SNMP LOCAL_NS:.tornet authenticationFailure  31-DEC-1992
                                                  14:53:25.51" ),
                                                (
                                   significance = True,
                                    information = "Event:
    authenticationFailure An authenticationFailure trap was received: 
    enterprise
                                                  = ""1.3.6.1.4.1.36.1"" 
    agent-addr = 16.20.144.140  generic-trap =
                                                  authenticationFailure 
    specific-trap = 0  time-stamp = 88614000" ),
                                                (
                                   significance = True,
                                    information = "(occurs (snmp * any
    event))" ) }
                             Managed Object = SNMP LOCAL_NS:.tornet
                         Perceived Severity = Warning
    
    
    MCC>! As expected the rule is fired since the LOCAL_NS:.tornet is in 
    MCC>! the domain 
    MCC>! Now delete LOCAL_NS:.tornet from the domain, and 
    MCC>! generate An authenticationFailure trap on system ".tornet".
    MCC>! The rule was not fired since the "LOCAL_NS:.tornet" is not
    MCC>! in the domain
    
    
    MCC>! Check version number Again
    MCC> sho mcc 0 alarms all char
    
    MCC 0 ALARMS
    AT 31-DEC-1992 14:57:30 Characteristics
    
    Examination of attributes shows:
                   Component Identification = "DECmcc Alarms FM"
                          Component Version = T1.3.0
    
    
    Has any one seen the problem in .3 with DECmcc T1.3.0?
    
    William
4293.5Sorry for my confused answer, BUT it works !!ZTOIS1::VISTARenato VISTA, SIS Strasbourg, FranceTue Jan 05 1993 04:5132
    
    
    
    Hi William,
    
    You're totally right about OCCURS(<class> * <event>) operating mode in
    T1.3.0. The problem has effectively been solved and fixed.
    
    I've just made a confusion in my .3 reply because of another problem
    about NOTIFICATION FM and dynamic taking account of new members of a
    given class in a given domain...
    
    ie NOTIFY REQUEST <domain> ENTITY LIST=(<class> *), EVENT=(any event)
    
    That kind of request must be DISABLEd/ENABLEd to include new members of
    a given in a given domain, in the request processed population. (In
    fact, this problem is STILL existing in T1.3.0 and will not be fixed in
    V1.3...).
    
    When I discovered it in V1.2.3 (Ultrix & VMS), I'd proposed the ALARMS
    FM mechanism (ie NOTIFY FM + ALARM FM + related Access Modules) as a
    workaround... And I'd also discovered the OCCURS problem in multiple
    domain environment... SO, you may understand my confused reply .3.
    
    Sorry and best regards,
    Renato
    
    PS : In ALARMS FM + occurs Rule environment (for a given domain), the 
    dynamic creation/deletion of members for this same domain ALSO seems to
    work correctly...