...

For this discussion we will assume that the concept of 'state' is important to the customer.  If there is a down event, there should be a corresponding up event.  It is possible that several down events could share a single up or clearing event.

State

opEvents tracks state based on a tuple of three event properties.

• node
• element
• stateful

This is a critical concept.  The node property will always be the same for any given node.  The element property will be somewhat dynamic, usually a regular express will parse it.  The most comment element example would be an interface; gig0/0 versus gig0/1.  The stateful property is necessary because the same element may have different events; consider an interface down event versus an OSPF event on the same element (gig0/0).

Create Parser Rules

opEvents will process the trap log file as specified on opCommon.nmis.  When parsing the traps the following properties should be extracted.

...

The install version of EventParserRules.nmis has a traplog section that will extract the date, host, trap and details fields for most situations.  This article will focus on situations where customers want customization for the remaining fields.

Set the Element

Setting the element is important