Highlighted
Respected Contributor.
Respected Contributor.
373 views

Filterfiles precendence

Jump to solution

Hello !

I have a problem understanding the difference between
trapfilter.conf and nnmtrapd.conf.

I understand that traps in the trapfilter.conf do not get
stored in the trap binaty store (and more) whereas traps
in the nnmtrapd.conf do.

But I am wondering, which of the filterfiles takes precedence
over the the other ? That is, if the same ip-address is in both files how does NNM decide what to do with it ?

Or should the same ip-address never be in both filterfiles ?

Or should only one filterfile be used at the same time ?

Regards

E Brandt

0 Likes
1 Solution

Accepted Solutions
Highlighted
Respected Contributor.
Respected Contributor.

Re: Filterfiles precendence

Jump to solution

Thanks for this clear answer, now I understand better why my filterconfig didnt work like I wanted it to.

View solution in original post

0 Likes
2 Replies
Highlighted
Acclaimed Contributor.
Acclaimed Contributor.

Re: Filterfiles precendence

Jump to solution

Hi Erwin,

  The two filter files  "trapFilter.conf" and "nnmtrapd.conf" are implemented in different parts of the "trapd" process.  In fact with the later versions of NNMi its now the "nnmtrapreceiver" that implements the filters in the "trapFilter.conf" file - so this has ramifications on how to enable them, as I will explain in a bit.

  Essentially "trapFilter.conf" is called the "Early" filter.  It will drop traps as soon as they arrive and this filtering has now been moved to the nnmtrapreceiver process.  For V1/V2 traps the IP and OID can be configured and can be dropped.  However for V3 traps ( with a recent hotfix ) only entries that have a ".*" wildcard for the OID can be dropped as the trap has yet to be decoded.  

  The nnmtrapd.conf file is called the "late" filter.  This is applied after the trap has gone through the "analytics" section of the code and been stored in the traplog.0  database file.  This is implemented in the "trapd" module of Ovjboss.

  If you put the same entry in both files then the trapFilter.conf file will take precedence.

  With the later versions of NNMi, if you make a change to the trapFilter.conf file and then you run the command "nnmtrapconfig.ovpl -readFilter"  you should then run the commands   "nnmtrapreceiver -stop ; nnmtrapreceiver -start"  in order for the process to re read the filters and implement them.   Also be careful of the output of the command "nnmtrapconfig.ovpl -dumpBlockList" as it pulls the filters out of the Ovjboss trapd module and not the nnmtrapreceiver process.  So having run the command, stop and start the nnmtrapreceiver to ensure it matches the output of the block list.

  I hope this all makes sense

Dave Y

MicroFocus Support
Viewed the Support tips? Search for "(NNMi) Support Tips" and order by Date to get the list
The views expressed in my contributions are my own and do not necessarily reflect the views and strategy of MicroFocus
If you find this or any post resolves your issue, please be sure to mark it as an accepted solution.
Highlighted
Respected Contributor.
Respected Contributor.

Re: Filterfiles precendence

Jump to solution

Thanks for this clear answer, now I understand better why my filterconfig didnt work like I wanted it to.

View solution in original post

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.