Filtering Events from switches to PCM

[Jason Scott]

This is very frustrating. It should be simple to filter out events coming from switches to PCM but I cannot get it to work.

To be clear from the start I want to filer the actual event traffic rather than simply filtering the display within PCM. I do not want switches sending certain events.

To that end I have tried using the command "no fault-finder all" and also "snmp-server enable host x.x.x.x "public" critical". I am still getting link up and down messages and all other information traps appearing constantly in PCM.

Can anyone offer guidance please?

[Les Ligetfalvy]

Are you talking about syslog or traplog? You can set a filter for Traps in Device Manager that work at the switch. Of course there is also the Ignore List in PCM that does not prevent the switches from sending, it prevents the trap receiver from accepting them. You can also do some SNMP pokes into a variety of OIDs to stop certain traps.

That said, link up/down events are an important indicator of problems and should not be suppressed but rather managed. I do suppress them in the traplog but they still do tend to fill up the syslog.

I have been pushing HP to improve their logs to employ real rules instead of simple filters. That way one could say, auto-acknowledge or auto-delete certain events based on rules. I have submitted several enhancement requests and am waiting for information on the upcoming PCM2 beta program.

[Jason Scott]

Thanks for your reply Les. I will give the ignore list a go in PCM.

I get frustrated with this product because it seems to be so incomplete in that it could do so much more in a much more elegant way. I look forward to seeing PCM2.

[Les Ligetfalvy]

IKWYM :(

I assume then you are talking about the traplog since that is the only place there is an Ignore List. It also has some user defined filters but they are simple include filters, not exclude. I setup a miriad of these include filters and toggle them one by one to either see what I want, or see what I don't want just long enough to acknowledge or delete them. I have an unacknowledged filter that I can then use to exclude what I have acknowledged.

It is a damn ugly kludge I know, but we learn to make do with the hand we're dealt. I wish HP had a forum dedicated to PCM where we could discuss its features/shortcomings/bugs.

[Jason Scott]

It would be nice to get in on the beta tests and discuss in a forum too. Maybe they're listening :)