Think about this... what if...
NetSaint, or NOCOL, or whatever monitoring package you used... was
converted to store ALL events in SQL. Rather than having an 'event
status' variable for each event with one single variable, you have
multiple events in the database for the same host, same service....
THEN...
You create a query-based view rather than an events-based view. For
example, with all the data in the database I could have a view that was
configured as something like...
select * from events where host = '1.2.3.4' and service = 'IPPING' and
status = 0 and count > 100
or
select peername, peerip from peers where id in (select id
from events where service = 'bgp' and status = 0 and count>1)
or something like that.
so rather than seeing a "yes its up" or a "no its down" I can see all the
information based on what i *want* to see... and being query-based, I can
also query it so that i will not see it if something else is down...or if
ten other things are down...you decide..
i'm interested in developing something like this...i have the database and
perl experience to do it, but a little short on the 'C' side. if some of
you would be interested in either porting nocol to something like this or
writing something completely separate, please let me know.
Thank you,
Jonathan A. Zdziarski
Sr. Systems Administrator
Netrail, inc.
888.NET.RAIL x240
http://www.netrail.net
|