How to Change SNMP Event Severity in Netcool Knowledge Library (NcKL)

Body

Changing the severity level, event type or expiry time of an event set by NcKL can easily be done just by changing the severity lookup entry. 

By default, NcKL assigns a specific severity level, event type and expiry time to each SNMP notification in the <Vendor>-<MIB Name>-include.snmptrap.rules using the following variables. The OS_EventID is the Event Identifier which is used as the lookup key in the severity lookup table.

$OS_EventId = "SNMPTRAP-ibm-ITNCM-MIB-itncmTaskAuthenticationFailureTrap"

$DEFAULT_Severity = 2

$DEFAULT_Type = 1

$DEFAULT_ExpireTime = 0

Each vendor rule set has a severity lookup file *.sev.snmptrap.lookup, for example: ibm-ITNCM-MIB-sev.snmptrap.lookup. This file defines a lookup table which will override the default values set in the *.include.snmptrap.rules.

To change or override the default severity value, modify the lookup values via EventID. By default, the values set in the entries should be the same as the values set in the *.include.snmptrap.rules file.

{"SNMPTRAP-ibm-ITNCM-MIB-itncmTaskAuthenticationFailureTrap","2","1","0"},

Entries in a Severity lookup table have the following format:

{<"EventId">,<"severity">,<"type">,<"expiretime">}

<"EventId"> is defined in the Rules File.  In some cases it is necessary to

add a modifier to the EventId to further clarify the condition.

Valid values for <severity> are:

  0 - clear

  1 - indeterminate

  2 - warning

  3 - minor

  4 - major

  5 - critical

  d - discard

Valid values for <type> are:

  1 - problem

  2 - resolution, NOTE: resolution alarms MUST have a <severity> of 1.

  11 - more severe

  12 - less severe

  13 - information

<expiretime> is the number of seconds the event will remain in the

ObjectServer before being automatically cleared. Alarms which should not

expire MUST have <expiretime> set to 0 (zero).