Technote (troubleshooting)
Problem(Abstract)
Customer needs to forward his NetIQ_Events that are being processed on TEC to Omnibus. He only wants to see his NetIQ_Events on Omnibus not his other events that are also being processed by TEC.
Symptom
Currently has rules forwarding set up but is seeing all his event from TEC being forwarded to Omnibus.
Resolving the problem
Solution: set up rules.forwarding with this rule to only send the
NetIQ_events.
ROOT@test.sys /tmp/test/TEC_RULES
vi netiq_omnibus.rls
*******************************************************************
****/
*
this ruleset is used for forwarding events
/
*************************** Reception Rules
***************************/
rule: forward:
event: _event of_class 'NetIQ_Event',
reception_action: forward:
re_send_event_conf('OmniBus_forward',_event)
--------------------------------------------------------------------------------------------
If however you'd rather forward ALL your events to Omnibus or another TEC server this rule would be used.
rule: forwardAll: (
event: _event of_class _class,
reception_action: (
re_send_event_conf('tec_forward',_event)
)
).
Rate this page:
Copyright and trademark information
IBM, the IBM logo and ibm.com are trademarks of International Business Machines Corp., registered in many jurisdictions worldwide. Other product and service names might be trademarks of IBM or other companies. A current list of IBM trademarks is available on the Web at "Copyright and trademark information" at www.ibm.com/legal/copytrade.shtml.