| >Is there a simple description available of how to do the above as well
>as a description of the error messages?
Not really.
>I've been able to define an action, but rather than be triggered by
>a specific event, it gets triggered by all events.
This is pretty common and has an easy solution. If you create a filter
and you define a list of events for that filter *and* you leave the
"filter call classes" button depressed you will see this phenomena.
This will happen *even if you have no classes specified on any event*
because "match all classes" also includes not having a class!!!
A brief description of each entity that you asked about follows:
event - some string of text that can be sent from a serviced systems
console that has some significant meaning.
scan profile - a grouping of events. Scan profiles are associated with
with serviced systems and define those events that will
be scanned for in text from the serviced system that
use the scan. Serviced systems may use the same scan
profile or different scan profiles. Note also that the
same event can be part of multiple profiles.
filters - "decision tables" that ENS applies each event to to
determine if this event should be sent to an action
routine.
Let's take the easiest case where we have an action that we wish to
take when any event occurs from any system. We'll call the filter
"Wildcard". By default when we create a new filter it is setup to
filter on everything so all we have to do is select an action and fill
in the userdata.
Now let's say we want production systems X, Y and Z to send us a mail
message when they crash. Note that we also have development systems
C, D and E and that we don't care if they crash. All systems utilize
the same scan profile called VMS_EVENTS and that the event BUGCHK is
defined and matches on the string "**** Fatal BUG CHECK". Note also
that we have another series of events that all relate to security
and we have associated them all with the class SECURITY_CLASS.
We will define a filter as follows and it is assumed that you are using
the Motif editor:
We'll create a filter and *deselect* the buttons "Filter all events",
"Filter all classes", "Filter all systems and "Filter all groups".
We will then selet the "Events..." button and use the resulting boxes to
select the BUGCHK event and then dismiss. We'll then select the
"Systems.." button and select systems X, Y and Z from the resulting
boxes and dismiss.
We will not do anything further with "Classes" and "Groups" becuase
we want only the BUGCHK event and we want only systems X, Y and Z. If
we fail to deselect those options then we would get mail for all events
and all systems. The one thing most folks miss is that we logically
.OR. the event and class fields together. We also logically .OR. the
system and groups fields together. So if any of the "Filter all...."
buttons is depressed then the ORing "always" returns TRUE - in effect
we have a boolean truth table here - and we get more actioning than was
intended.
Lastly we will use the "Select" button and the resulting boxes to
associate the Mail action with this filter. We will use the Add button
to fill in the Userdata box with a list of addressees to send the mail
to - one per line.
I hope this helps!
Regs,
Dan
|