[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: snmpconf-pm-04 notes



>>>>> On Wed, 28 Feb 2001 21:40:26 -0800, Steve Waldbusser <waldbusser@nextbeacon.com> said:

>> Now, if that trap goes un-received, though, then the broken script may
>> not be noticed for a while.  I'd still be tempted to send them out
>> every X number of seconds (defaulting to 60 minutes, say, as you would
>> like).  If X is 0, only send one (note that this is a different
>> configuration item than discussed below where throttling from toggling
>> is discussed):

Steve> Let's only talk about informs.

Ok:

Now, if that inform doesn't get acknowledged, though, then the broken
script may not be noticed for a while.  I'd still be tempted to
attempt to send them out every X number of seconds (defaulting to 60
minutes, say, as you would like).  If X is 0, only send one (note that
this is a different configuration item than discussed below where
throttling from toggling is discussed):

Steve> Statesmanlike as I am, I'm willing to let you choose!


Steve> Well, as I was going round and round on this, I came up with:
Steve> - Maybe we need a configurable time-threshold per policy
Steve> - Maybe we need to be able to shut up notifications from a policy that
Steve>   is broken on some elements but for which no fix is planned.
Steve> - Maybe we need to configure the "0" threshold (allow N to break?)
Steve> - Maybe we want a higher severity "N" threshold or "N%" threshold or
Steve>   "100%" threshold (as in failed on X% of elements).

#2 can be done via the NOTFICATION-MIB outgoing filter tables, btw,
and may not be required to be done here.

You can certainly make everything really configurable, admittedly.
I know you're trying to point out the opposite end of the
spectrum, but the overhead of having a per-policy time threshold is
probably not worth it in most peoples minds (though, I'm sure someone
would make use of it).

Certainly the methods by which the thing can be throttled need to be
thought about, and your notion of N or N% is something to consider.

Steve> Should EVERYTHING really be configurable? Let me really
Steve> emphasize my earlier statement about estimating user needs - I
Steve> think it's too early to tell what the needs will be for this
Steve> feature. And I'm definitely wishing we were hearing other's
Steve> opinions and advice about this.

Sounds like we should await others opinions since we haven't come to
an agreement yet between ourselves :-)

Steve> Maybe we should just defer this to the event MIB.

Jon recently convinced me (mostly) that notifications like this should
be done regardless of whether there is support for the event mib
around or not.  Particularly if they security related.

-- 
Wes Hardaker
NAI Labs
Network Associates