Table of contents

Summary

Have certain NMIS events sent to IBM Tivoli Netcool using syslog.

Requirements

Send certain events to Netcool, which will can be done by ignoring the events not required.

Solution

Files:
noc.pm -> /usr/local/nmis8/lib/Notify/noc.pm
nocBlackList.txt -> /usr/local/nmis8/conf/nocBlackList.txt

noc.pm is the logic for this notification and the nocBlackList.txt is a list of events you do NOT WANT to send, each event on a blank line, so if you do not want to send “Proactive Interface Input Utilisation" and "Proactive Interface Output Utilisation” because you have a custom system for that, those would be in the file and I have included them now.

To configure this, you add the method in the policy where you require it, for example

'default_default_default_default__' =>

{ 'Event' => 'default', 'Event_Element' => '', 'Event_Node' => '', 'Group' => 'default', 'Level0' => 'noc:noc_contact,syslog:localhost', 'Level1' => '', 'Level10' => '', 'Level2' => '', 'Level3' => '', 'Level4' => '', 'Level5' => '', 'Level6' => '', 'Level7' => '', 'Level8' => '', 'Level9' => '', 'Role' => 'default', 'Type' => 'default', 'UpNotify' => 'true' }

,

Here “noc:noc_contact” has been added to the escalation policy. The first part noc names the custom notification method matching the code in noc.pm and noc_contact must be a contact in the Contacts.nmis file in lower case, this is used for criticality filtering and duty time only.

'noc_contact' =>

{ 'Contact' => 'noc_contact', 'DutyTime' => '00:24:MonTueWedThuFriSatSun', 'Email' => 'nobody@localhost', 'Location' => 'default', 'Level' => '(Fatal|Critical|Major|Minor|Warning|Normal)', 'Mobile' => '', 'Pager' => '', 'Phone' => '', 'TimeZone' => '0' }

,

You just need to configure the syslog server in the code in this following lines:
my $syslog_facility = 'local3';
my $syslog_server = 'localhost:udp:514’;

I have tested this on VM23, I added the syslog config:
local3.* /usr/local/nmis8/logs/noc_slave_event.log

This is working well, my problems with testing were that your Contacts.nmis had upper case contact names in it, these should all be lower case, so I created a new contact noc_contact and it works a treat.

There is a trivial testing script called /usr/local/nmis8/test/t_notify.pl which will generate some dummy events into the system and trigger the escalation and special syslog.

The only thing which hasn’t been possible is the formatting of the message as described in the document, that is because NMIS is already adding the interface description and bandwidth if configured to do so before this gets the event, I have left the code there. Please review the results and let me know how you would like to proceed.