Details
Description
A customer asked me if there is a way to alter the content of event definitions coming from OIA. In particular, an event defined by ALEC.
That is entirely possible by creating a new event definition with a priority element.
The problem is that after doing that, and instruction OpenNMS to reload the event configuration, the number of events displayed by the show-event-config command is incorrect.
Let me explain with an example:
admin@opennms> opennms:show-event-config -u uei.opennms.org/vendor/Cisco/traps/cikeTunnelStop Event #1 <event xmlns="http://xmlns.opennms.org/xsd/eventconf"> <mask> <maskelement> <mename>id</mename> <mevalue>.1.3.6.1.4.1.9.9.171.2</mevalue> </maskelement> <maskelement> <mename>generic</mename> <mevalue>6</mevalue> </maskelement> <maskelement> <mename>specific</mename> <mevalue>2</mevalue> </maskelement> </mask> <uei>uei.opennms.org/vendor/Cisco/traps/cikeTunnelStop</uei> <priority>0</priority> <event-label>CISCO-IPSEC-FLOW-MONITOR-MIB defined trap event: cikeTunnelStop</event-label> <descr><p>This notification is generated when an IPsec Phase-1 IKE Tunnel becomes inactive.</p><table> <tr><td><b> cikePeerLocalAddr</b></td><td>%parm[#1]% </td><td><p;></p></td;></tr><tr><td><b> cikePeerRemoteAddr</b></td><td>%parm[#2]% </td><td><p;></p></td;></tr><tr><td><b> cikeTunActiveTime</b></td><td>%parm[#3]% </td><td><p;></p></td;></tr></table></descr> <logmsg dest="logndisplay">Cisco Event: IPSEC Phase-1 IKE Tunnel inactive for peer %parm[peerRemoteAddr]%</logmsg> <severity>Warning</severity> <parameter name="peerLocalAddr" value="%parm[#1]%" expand="true"/> <parameter name="peerRemoteAddr" value="%parm[#2]%" expand="true"/> <parameter name="tunnelId" value="%parm[name-#3.-1]%" expand="true"/> <alarm-data reduction-key="%uei%:%dpname%:%nodeid%:%parm[peerLocalAddr]%:%parm[peerRemoteAddr]%:%parm[tunnelId]%" alarm-type="1" auto-clean="false"> <managed-object type="vpn-tunnel"/> </alarm-data> </event>Event #2 <event xmlns="http://xmlns.opennms.org/xsd/eventconf"> <mask> <maskelement> <mename>id</mename> <mevalue>.1.3.6.1.4.1.9.9.171.2</mevalue> </maskelement> <maskelement> <mename>generic</mename> <mevalue>6</mevalue> </maskelement> <maskelement> <mename>specific</mename> <mevalue>2</mevalue> </maskelement> </mask> <uei>uei.opennms.org/vendor/Cisco/traps/cikeTunnelStop</uei> <priority>0</priority> <event-label>CISCO-IPSEC-FLOW-MONITOR-MIB defined trap event: cikeTunnelStop</event-label> <descr><p>This notification is generated when an IPsec Phase-1 IKE Tunnel becomes inactive.</p><table> <tr><td><b> cikePeerLocalAddr</b></td><td>%parm[#1]% </td><td><p;></p></td;></tr><tr><td><b> cikePeerRemoteAddr</b></td><td>%parm[#2]% </td><td><p;></p></td;></tr><tr><td><b> cikeTunActiveTime</b></td><td>%parm[#3]% </td><td><p;></p></td;></tr></table></descr> <logmsg dest="logndisplay">Cisco Event: IPSEC Phase-1 IKE Tunnel inactive for peer %parm[peerRemoteAddr]%</logmsg> <severity>Warning</severity> <parameter name="peerLocalAddr" value="%parm[#1]%" expand="true"/> <parameter name="peerRemoteAddr" value="%parm[#2]%" expand="true"/> <parameter name="tunnelId" value="%parm[name-#3.-1]%" expand="true"/> <alarm-data reduction-key="%uei%:%dpname%:%nodeid%:%parm[peerLocalAddr]%:%parm[peerRemoteAddr]%:%parm[tunnelId]%" alarm-type="1" auto-clean="false"> <managed-object type="vpn-tunnel"/> </alarm-data> </event>
The above is the expected result for that event definition. The first entry is coming from ALEC, as defined in the following link:
The second one is part of the OpenNMS default configuration (defined inside /opt/opennms/etc/events/Cisco.events.xml).
As expected, event definitions coming via OIA takes more precedence than definitions that OpenNMS provides by default.
This can be altered with the priority field.
I added a new event definitions file with an altered version of the event offered by ALEC:
[root@horizon ~]# cat /opt/opennms/etc/events/ALEC-Altered.events.xml <events xmlns="http://xmlns.opennms.org/xsd/eventconf"> <event xmlns="http://xmlns.opennms.org/xsd/eventconf"> <mask> <maskelement> <mename>id</mename> <mevalue>.1.3.6.1.4.1.9.9.171.2</mevalue> </maskelement> <maskelement> <mename>generic</mename> <mevalue>6</mevalue> </maskelement> <maskelement> <mename>specific</mename> <mevalue>2</mevalue> </maskelement> </mask> <uei>uei.opennms.org/vendor/Cisco/traps/cikeTunnelStop</uei> <priority>10</priority> <event-label>CISCO-IPSEC-FLOW-MONITOR-MIB defined trap event: cikeTunnelStop (version 2)</event-label> <descr>This notification is generated when an IPsec Phase-1 IKE Tunnel becomes inactive for peer %parm[peerRemoteAddr]%</descr> <logmsg dest="logndisplay">Cisco Event: IPSEC Phase-1 IKE Tunnel inactive for peer %parm[peerRemoteAddr]%</logmsg> <severity>Warning</severity> <parameter name="peerLocalAddr" value="%parm[#1]%" expand="true"/> <parameter name="peerRemoteAddr" value="%parm[#2]%" expand="true"/> <parameter name="tunnelId" value="%parm[name-#3.-1]%" expand="true"/> <alarm-data reduction-key="%uei%:%dpname%:%nodeid%:%parm[peerLocalAddr]%:%parm[peerRemoteAddr]%:%parm[tunnelId]%" alarm-type="1" auto-clean="false"> <managed-object type="vpn-tunnel"/> </alarm-data> </event> </events> [root@horizon ~]# head -n 12 /opt/opennms/etc/eventconf.xml <events xmlns="http://xmlns.opennms.org/xsd/eventconf"> <global> <security> <doNotOverride>logmsg</doNotOverride> <doNotOverride>operaction</doNotOverride> <doNotOverride>autoaction</doNotOverride> <doNotOverride>tticket</doNotOverride> <doNotOverride>script</doNotOverride> </security> </global> <event-file>events/ALEC-Altered.events.xml</event-file> <event-file>events/opennms.snmp.trap.translator.events.xml</event-file> [root@horizon ~]# /opt/opennms/bin/send-event.pl -p 'daemonName Eventd' uei.opennms.org/internal/reloadDaemonConfig
If I run the show-event-config again, I would expect to see three (3) definitions, having the one I added at the top of the list due to its priority. Instead, I'm seeing six (6) copies of the definition I just added, and the ones that were already present are gone.
admin@opennms> opennms:show-event-config -u uei.opennms.org/vendor/Cisco/traps/cikeTunnelStop Event #1 <event xmlns="http://xmlns.opennms.org/xsd/eventconf"> <mask> <maskelement> <mename>id</mename> <mevalue>.1.3.6.1.4.1.9.9.171.2</mevalue> </maskelement> <maskelement> <mename>generic</mename> <mevalue>6</mevalue> </maskelement> <maskelement> <mename>specific</mename> <mevalue>2</mevalue> </maskelement> </mask> <uei>uei.opennms.org/vendor/Cisco/traps/cikeTunnelStop</uei> <priority>10</priority> <event-label>CISCO-IPSEC-FLOW-MONITOR-MIB defined trap event: cikeTunnelStop (version 2)</event-label> <descr>This notification is generated when an IPsec Phase-1 IKE Tunnel becomes inactive for peer %parm[peerRemoteAddr]%</descr> <logmsg dest="logndisplay">Cisco Event: IPSEC Phase-1 IKE Tunnel inactive for peer %parm[peerRemoteAddr]%</logmsg> <severity>Warning</severity> <parameter name="peerLocalAddr" value="%parm[#1]%" expand="true"/> <parameter name="peerRemoteAddr" value="%parm[#2]%" expand="true"/> <parameter name="tunnelId" value="%parm[name-#3.-1]%" expand="true"/> <alarm-data reduction-key="%uei%:%dpname%:%nodeid%:%parm[peerLocalAddr]%:%parm[peerRemoteAddr]%:%parm[tunnelId]%" alarm-type="1" auto-clean="false"> <managed-object type="vpn-tunnel"/> </alarm-data> </event>Event #2 <event xmlns="http://xmlns.opennms.org/xsd/eventconf"> <mask> <maskelement> <mename>id</mename> <mevalue>.1.3.6.1.4.1.9.9.171.2</mevalue> </maskelement> <maskelement> <mename>generic</mename> <mevalue>6</mevalue> </maskelement> <maskelement> <mename>specific</mename> <mevalue>2</mevalue> </maskelement> </mask> <uei>uei.opennms.org/vendor/Cisco/traps/cikeTunnelStop</uei> <priority>10</priority> <event-label>CISCO-IPSEC-FLOW-MONITOR-MIB defined trap event: cikeTunnelStop (version 2)</event-label> <descr>This notification is generated when an IPsec Phase-1 IKE Tunnel becomes inactive for peer %parm[peerRemoteAddr]%</descr> <logmsg dest="logndisplay">Cisco Event: IPSEC Phase-1 IKE Tunnel inactive for peer %parm[peerRemoteAddr]%</logmsg> <severity>Warning</severity> <parameter name="peerLocalAddr" value="%parm[#1]%" expand="true"/> <parameter name="peerRemoteAddr" value="%parm[#2]%" expand="true"/> <parameter name="tunnelId" value="%parm[name-#3.-1]%" expand="true"/> <alarm-data reduction-key="%uei%:%dpname%:%nodeid%:%parm[peerLocalAddr]%:%parm[peerRemoteAddr]%:%parm[tunnelId]%" alarm-type="1" auto-clean="false"> <managed-object type="vpn-tunnel"/> </alarm-data> </event>Event #3 <event xmlns="http://xmlns.opennms.org/xsd/eventconf"> <mask> <maskelement> <mename>id</mename> <mevalue>.1.3.6.1.4.1.9.9.171.2</mevalue> </maskelement> <maskelement> <mename>generic</mename> <mevalue>6</mevalue> </maskelement> <maskelement> <mename>specific</mename> <mevalue>2</mevalue> </maskelement> </mask> <uei>uei.opennms.org/vendor/Cisco/traps/cikeTunnelStop</uei> <priority>10</priority> <event-label>CISCO-IPSEC-FLOW-MONITOR-MIB defined trap event: cikeTunnelStop (version 2)</event-label> <descr>This notification is generated when an IPsec Phase-1 IKE Tunnel becomes inactive for peer %parm[peerRemoteAddr]%</descr> <logmsg dest="logndisplay">Cisco Event: IPSEC Phase-1 IKE Tunnel inactive for peer %parm[peerRemoteAddr]%</logmsg> <severity>Warning</severity> <parameter name="peerLocalAddr" value="%parm[#1]%" expand="true"/> <parameter name="peerRemoteAddr" value="%parm[#2]%" expand="true"/> <parameter name="tunnelId" value="%parm[name-#3.-1]%" expand="true"/> <alarm-data reduction-key="%uei%:%dpname%:%nodeid%:%parm[peerLocalAddr]%:%parm[peerRemoteAddr]%:%parm[tunnelId]%" alarm-type="1" auto-clean="false"> <managed-object type="vpn-tunnel"/> </alarm-data> </event>Event #4 <event xmlns="http://xmlns.opennms.org/xsd/eventconf"> <mask> <maskelement> <mename>id</mename> <mevalue>.1.3.6.1.4.1.9.9.171.2</mevalue> </maskelement> <maskelement> <mename>generic</mename> <mevalue>6</mevalue> </maskelement> <maskelement> <mename>specific</mename> <mevalue>2</mevalue> </maskelement> </mask> <uei>uei.opennms.org/vendor/Cisco/traps/cikeTunnelStop</uei> <priority>10</priority> <event-label>CISCO-IPSEC-FLOW-MONITOR-MIB defined trap event: cikeTunnelStop (version 2)</event-label> <descr>This notification is generated when an IPsec Phase-1 IKE Tunnel becomes inactive for peer %parm[peerRemoteAddr]%</descr> <logmsg dest="logndisplay">Cisco Event: IPSEC Phase-1 IKE Tunnel inactive for peer %parm[peerRemoteAddr]%</logmsg> <severity>Warning</severity> <parameter name="peerLocalAddr" value="%parm[#1]%" expand="true"/> <parameter name="peerRemoteAddr" value="%parm[#2]%" expand="true"/> <parameter name="tunnelId" value="%parm[name-#3.-1]%" expand="true"/> <alarm-data reduction-key="%uei%:%dpname%:%nodeid%:%parm[peerLocalAddr]%:%parm[peerRemoteAddr]%:%parm[tunnelId]%" alarm-type="1" auto-clean="false"> <managed-object type="vpn-tunnel"/> </alarm-data> </event>Event #5 <event xmlns="http://xmlns.opennms.org/xsd/eventconf"> <mask> <maskelement> <mename>id</mename> <mevalue>.1.3.6.1.4.1.9.9.171.2</mevalue> </maskelement> <maskelement> <mename>generic</mename> <mevalue>6</mevalue> </maskelement> <maskelement> <mename>specific</mename> <mevalue>2</mevalue> </maskelement> </mask> <uei>uei.opennms.org/vendor/Cisco/traps/cikeTunnelStop</uei> <priority>10</priority> <event-label>CISCO-IPSEC-FLOW-MONITOR-MIB defined trap event: cikeTunnelStop (version 2)</event-label> <descr>This notification is generated when an IPsec Phase-1 IKE Tunnel becomes inactive for peer %parm[peerRemoteAddr]%</descr> <logmsg dest="logndisplay">Cisco Event: IPSEC Phase-1 IKE Tunnel inactive for peer %parm[peerRemoteAddr]%</logmsg> <severity>Warning</severity> <parameter name="peerLocalAddr" value="%parm[#1]%" expand="true"/> <parameter name="peerRemoteAddr" value="%parm[#2]%" expand="true"/> <parameter name="tunnelId" value="%parm[name-#3.-1]%" expand="true"/> <alarm-data reduction-key="%uei%:%dpname%:%nodeid%:%parm[peerLocalAddr]%:%parm[peerRemoteAddr]%:%parm[tunnelId]%" alarm-type="1" auto-clean="false"> <managed-object type="vpn-tunnel"/> </alarm-data> </event>Event #6 <event xmlns="http://xmlns.opennms.org/xsd/eventconf"> <mask> <maskelement> <mename>id</mename> <mevalue>.1.3.6.1.4.1.9.9.171.2</mevalue> </maskelement> <maskelement> <mename>generic</mename> <mevalue>6</mevalue> </maskelement> <maskelement> <mename>specific</mename> <mevalue>2</mevalue> </maskelement> </mask> <uei>uei.opennms.org/vendor/Cisco/traps/cikeTunnelStop</uei> <priority>10</priority> <event-label>CISCO-IPSEC-FLOW-MONITOR-MIB defined trap event: cikeTunnelStop (version 2)</event-label> <descr>This notification is generated when an IPsec Phase-1 IKE Tunnel becomes inactive for peer %parm[peerRemoteAddr]%</descr> <logmsg dest="logndisplay">Cisco Event: IPSEC Phase-1 IKE Tunnel inactive for peer %parm[peerRemoteAddr]%</logmsg> <severity>Warning</severity> <parameter name="peerLocalAddr" value="%parm[#1]%" expand="true"/> <parameter name="peerRemoteAddr" value="%parm[#2]%" expand="true"/> <parameter name="tunnelId" value="%parm[name-#3.-1]%" expand="true"/> <alarm-data reduction-key="%uei%:%dpname%:%nodeid%:%parm[peerLocalAddr]%:%parm[peerRemoteAddr]%:%parm[tunnelId]%" alarm-type="1" auto-clean="false"> <managed-object type="vpn-tunnel"/> </alarm-data> </event>
That is definitely not expected.
Interestingly, if I restart OpenNMS, to see if the behavior was due to the reload process, I found that the problem is now worst. It shows ten (10) entries:
admin@opennms> opennms:show-event-config -u uei.opennms.org/vendor/Cisco/traps/cikeTunnelStop Event #1 <event xmlns="http://xmlns.opennms.org/xsd/eventconf"> <mask> <maskelement> <mename>id</mename> <mevalue>.1.3.6.1.4.1.9.9.171.2</mevalue> </maskelement> <maskelement> <mename>generic</mename> <mevalue>6</mevalue> </maskelement> <maskelement> <mename>specific</mename> <mevalue>2</mevalue> </maskelement> </mask> <uei>uei.opennms.org/vendor/Cisco/traps/cikeTunnelStop</uei> <priority>10</priority> <event-label>CISCO-IPSEC-FLOW-MONITOR-MIB defined trap event: cikeTunnelStop (version 2)</event-label> <descr>This notification is generated when an IPsec Phase-1 IKE Tunnel becomes inactive for peer %parm[peerRemoteAddr]%</descr> <logmsg dest="logndisplay">Cisco Event: IPSEC Phase-1 IKE Tunnel inactive for peer %parm[peerRemoteAddr]%</logmsg> <severity>Warning</severity> <parameter name="peerLocalAddr" value="%parm[#1]%" expand="true"/> <parameter name="peerRemoteAddr" value="%parm[#2]%" expand="true"/> <parameter name="tunnelId" value="%parm[name-#3.-1]%" expand="true"/> <alarm-data reduction-key="%uei%:%dpname%:%nodeid%:%parm[peerLocalAddr]%:%parm[peerRemoteAddr]%:%parm[tunnelId]%" alarm-type="1" auto-clean="false"> <managed-object type="vpn-tunnel"/> </alarm-data> </event>Event #2 <event xmlns="http://xmlns.opennms.org/xsd/eventconf"> <mask> <maskelement> <mename>id</mename> <mevalue>.1.3.6.1.4.1.9.9.171.2</mevalue> </maskelement> <maskelement> <mename>generic</mename> <mevalue>6</mevalue> </maskelement> <maskelement> <mename>specific</mename> <mevalue>2</mevalue> </maskelement> </mask> <uei>uei.opennms.org/vendor/Cisco/traps/cikeTunnelStop</uei> <priority>10</priority> <event-label>CISCO-IPSEC-FLOW-MONITOR-MIB defined trap event: cikeTunnelStop (version 2)</event-label> <descr>This notification is generated when an IPsec Phase-1 IKE Tunnel becomes inactive for peer %parm[peerRemoteAddr]%</descr> <logmsg dest="logndisplay">Cisco Event: IPSEC Phase-1 IKE Tunnel inactive for peer %parm[peerRemoteAddr]%</logmsg> <severity>Warning</severity> <parameter name="peerLocalAddr" value="%parm[#1]%" expand="true"/> <parameter name="peerRemoteAddr" value="%parm[#2]%" expand="true"/> <parameter name="tunnelId" value="%parm[name-#3.-1]%" expand="true"/> <alarm-data reduction-key="%uei%:%dpname%:%nodeid%:%parm[peerLocalAddr]%:%parm[peerRemoteAddr]%:%parm[tunnelId]%" alarm-type="1" auto-clean="false"> <managed-object type="vpn-tunnel"/> </alarm-data> </event>Event #3 <event xmlns="http://xmlns.opennms.org/xsd/eventconf"> <mask> <maskelement> <mename>id</mename> <mevalue>.1.3.6.1.4.1.9.9.171.2</mevalue> </maskelement> <maskelement> <mename>generic</mename> <mevalue>6</mevalue> </maskelement> <maskelement> <mename>specific</mename> <mevalue>2</mevalue> </maskelement> </mask> <uei>uei.opennms.org/vendor/Cisco/traps/cikeTunnelStop</uei> <priority>10</priority> <event-label>CISCO-IPSEC-FLOW-MONITOR-MIB defined trap event: cikeTunnelStop (version 2)</event-label> <descr>This notification is generated when an IPsec Phase-1 IKE Tunnel becomes inactive for peer %parm[peerRemoteAddr]%</descr> <logmsg dest="logndisplay">Cisco Event: IPSEC Phase-1 IKE Tunnel inactive for peer %parm[peerRemoteAddr]%</logmsg> <severity>Warning</severity> <parameter name="peerLocalAddr" value="%parm[#1]%" expand="true"/> <parameter name="peerRemoteAddr" value="%parm[#2]%" expand="true"/> <parameter name="tunnelId" value="%parm[name-#3.-1]%" expand="true"/> <alarm-data reduction-key="%uei%:%dpname%:%nodeid%:%parm[peerLocalAddr]%:%parm[peerRemoteAddr]%:%parm[tunnelId]%" alarm-type="1" auto-clean="false"> <managed-object type="vpn-tunnel"/> </alarm-data> </event>Event #4 <event xmlns="http://xmlns.opennms.org/xsd/eventconf"> <mask> <maskelement> <mename>id</mename> <mevalue>.1.3.6.1.4.1.9.9.171.2</mevalue> </maskelement> <maskelement> <mename>generic</mename> <mevalue>6</mevalue> </maskelement> <maskelement> <mename>specific</mename> <mevalue>2</mevalue> </maskelement> </mask> <uei>uei.opennms.org/vendor/Cisco/traps/cikeTunnelStop</uei> <priority>10</priority> <event-label>CISCO-IPSEC-FLOW-MONITOR-MIB defined trap event: cikeTunnelStop (version 2)</event-label> <descr>This notification is generated when an IPsec Phase-1 IKE Tunnel becomes inactive for peer %parm[peerRemoteAddr]%</descr> <logmsg dest="logndisplay">Cisco Event: IPSEC Phase-1 IKE Tunnel inactive for peer %parm[peerRemoteAddr]%</logmsg> <severity>Warning</severity> <parameter name="peerLocalAddr" value="%parm[#1]%" expand="true"/> <parameter name="peerRemoteAddr" value="%parm[#2]%" expand="true"/> <parameter name="tunnelId" value="%parm[name-#3.-1]%" expand="true"/> <alarm-data reduction-key="%uei%:%dpname%:%nodeid%:%parm[peerLocalAddr]%:%parm[peerRemoteAddr]%:%parm[tunnelId]%" alarm-type="1" auto-clean="false"> <managed-object type="vpn-tunnel"/> </alarm-data> </event>Event #5 <event xmlns="http://xmlns.opennms.org/xsd/eventconf"> <mask> <maskelement> <mename>id</mename> <mevalue>.1.3.6.1.4.1.9.9.171.2</mevalue> </maskelement> <maskelement> <mename>generic</mename> <mevalue>6</mevalue> </maskelement> <maskelement> <mename>specific</mename> <mevalue>2</mevalue> </maskelement> </mask> <uei>uei.opennms.org/vendor/Cisco/traps/cikeTunnelStop</uei> <priority>10</priority> <event-label>CISCO-IPSEC-FLOW-MONITOR-MIB defined trap event: cikeTunnelStop (version 2)</event-label> <descr>This notification is generated when an IPsec Phase-1 IKE Tunnel becomes inactive for peer %parm[peerRemoteAddr]%</descr> <logmsg dest="logndisplay">Cisco Event: IPSEC Phase-1 IKE Tunnel inactive for peer %parm[peerRemoteAddr]%</logmsg> <severity>Warning</severity> <parameter name="peerLocalAddr" value="%parm[#1]%" expand="true"/> <parameter name="peerRemoteAddr" value="%parm[#2]%" expand="true"/> <parameter name="tunnelId" value="%parm[name-#3.-1]%" expand="true"/> <alarm-data reduction-key="%uei%:%dpname%:%nodeid%:%parm[peerLocalAddr]%:%parm[peerRemoteAddr]%:%parm[tunnelId]%" alarm-type="1" auto-clean="false"> <managed-object type="vpn-tunnel"/> </alarm-data> </event>Event #6 <event xmlns="http://xmlns.opennms.org/xsd/eventconf"> <mask> <maskelement> <mename>id</mename> <mevalue>.1.3.6.1.4.1.9.9.171.2</mevalue> </maskelement> <maskelement> <mename>generic</mename> <mevalue>6</mevalue> </maskelement> <maskelement> <mename>specific</mename> <mevalue>2</mevalue> </maskelement> </mask> <uei>uei.opennms.org/vendor/Cisco/traps/cikeTunnelStop</uei> <priority>10</priority> <event-label>CISCO-IPSEC-FLOW-MONITOR-MIB defined trap event: cikeTunnelStop (version 2)</event-label> <descr>This notification is generated when an IPsec Phase-1 IKE Tunnel becomes inactive for peer %parm[peerRemoteAddr]%</descr> <logmsg dest="logndisplay">Cisco Event: IPSEC Phase-1 IKE Tunnel inactive for peer %parm[peerRemoteAddr]%</logmsg> <severity>Warning</severity> <parameter name="peerLocalAddr" value="%parm[#1]%" expand="true"/> <parameter name="peerRemoteAddr" value="%parm[#2]%" expand="true"/> <parameter name="tunnelId" value="%parm[name-#3.-1]%" expand="true"/> <alarm-data reduction-key="%uei%:%dpname%:%nodeid%:%parm[peerLocalAddr]%:%parm[peerRemoteAddr]%:%parm[tunnelId]%" alarm-type="1" auto-clean="false"> <managed-object type="vpn-tunnel"/> </alarm-data> </event>Event #7 <event xmlns="http://xmlns.opennms.org/xsd/eventconf"> <mask> <maskelement> <mename>id</mename> <mevalue>.1.3.6.1.4.1.9.9.171.2</mevalue> </maskelement> <maskelement> <mename>generic</mename> <mevalue>6</mevalue> </maskelement> <maskelement> <mename>specific</mename> <mevalue>2</mevalue> </maskelement> </mask> <uei>uei.opennms.org/vendor/Cisco/traps/cikeTunnelStop</uei> <priority>10</priority> <event-label>CISCO-IPSEC-FLOW-MONITOR-MIB defined trap event: cikeTunnelStop (version 2)</event-label> <descr>This notification is generated when an IPsec Phase-1 IKE Tunnel becomes inactive for peer %parm[peerRemoteAddr]%</descr> <logmsg dest="logndisplay">Cisco Event: IPSEC Phase-1 IKE Tunnel inactive for peer %parm[peerRemoteAddr]%</logmsg> <severity>Warning</severity> <parameter name="peerLocalAddr" value="%parm[#1]%" expand="true"/> <parameter name="peerRemoteAddr" value="%parm[#2]%" expand="true"/> <parameter name="tunnelId" value="%parm[name-#3.-1]%" expand="true"/> <alarm-data reduction-key="%uei%:%dpname%:%nodeid%:%parm[peerLocalAddr]%:%parm[peerRemoteAddr]%:%parm[tunnelId]%" alarm-type="1" auto-clean="false"> <managed-object type="vpn-tunnel"/> </alarm-data> </event>Event #8 <event xmlns="http://xmlns.opennms.org/xsd/eventconf"> <mask> <maskelement> <mename>id</mename> <mevalue>.1.3.6.1.4.1.9.9.171.2</mevalue> </maskelement> <maskelement> <mename>generic</mename> <mevalue>6</mevalue> </maskelement> <maskelement> <mename>specific</mename> <mevalue>2</mevalue> </maskelement> </mask> <uei>uei.opennms.org/vendor/Cisco/traps/cikeTunnelStop</uei> <priority>10</priority> <event-label>CISCO-IPSEC-FLOW-MONITOR-MIB defined trap event: cikeTunnelStop (version 2)</event-label> <descr>This notification is generated when an IPsec Phase-1 IKE Tunnel becomes inactive for peer %parm[peerRemoteAddr]%</descr> <logmsg dest="logndisplay">Cisco Event: IPSEC Phase-1 IKE Tunnel inactive for peer %parm[peerRemoteAddr]%</logmsg> <severity>Warning</severity> <parameter name="peerLocalAddr" value="%parm[#1]%" expand="true"/> <parameter name="peerRemoteAddr" value="%parm[#2]%" expand="true"/> <parameter name="tunnelId" value="%parm[name-#3.-1]%" expand="true"/> <alarm-data reduction-key="%uei%:%dpname%:%nodeid%:%parm[peerLocalAddr]%:%parm[peerRemoteAddr]%:%parm[tunnelId]%" alarm-type="1" auto-clean="false"> <managed-object type="vpn-tunnel"/> </alarm-data> </event>Event #9 <event xmlns="http://xmlns.opennms.org/xsd/eventconf"> <mask> <maskelement> <mename>id</mename> <mevalue>.1.3.6.1.4.1.9.9.171.2</mevalue> </maskelement> <maskelement> <mename>generic</mename> <mevalue>6</mevalue> </maskelement> <maskelement> <mename>specific</mename> <mevalue>2</mevalue> </maskelement> </mask> <uei>uei.opennms.org/vendor/Cisco/traps/cikeTunnelStop</uei> <priority>10</priority> <event-label>CISCO-IPSEC-FLOW-MONITOR-MIB defined trap event: cikeTunnelStop (version 2)</event-label> <descr>This notification is generated when an IPsec Phase-1 IKE Tunnel becomes inactive for peer %parm[peerRemoteAddr]%</descr> <logmsg dest="logndisplay">Cisco Event: IPSEC Phase-1 IKE Tunnel inactive for peer %parm[peerRemoteAddr]%</logmsg> <severity>Warning</severity> <parameter name="peerLocalAddr" value="%parm[#1]%" expand="true"/> <parameter name="peerRemoteAddr" value="%parm[#2]%" expand="true"/> <parameter name="tunnelId" value="%parm[name-#3.-1]%" expand="true"/> <alarm-data reduction-key="%uei%:%dpname%:%nodeid%:%parm[peerLocalAddr]%:%parm[peerRemoteAddr]%:%parm[tunnelId]%" alarm-type="1" auto-clean="false"> <managed-object type="vpn-tunnel"/> </alarm-data> </event>Event #10 <event xmlns="http://xmlns.opennms.org/xsd/eventconf"> <mask> <maskelement> <mename>id</mename> <mevalue>.1.3.6.1.4.1.9.9.171.2</mevalue> </maskelement> <maskelement> <mename>generic</mename> <mevalue>6</mevalue> </maskelement> <maskelement> <mename>specific</mename> <mevalue>2</mevalue> </maskelement> </mask> <uei>uei.opennms.org/vendor/Cisco/traps/cikeTunnelStop</uei> <priority>10</priority> <event-label>CISCO-IPSEC-FLOW-MONITOR-MIB defined trap event: cikeTunnelStop (version 2)</event-label> <descr>This notification is generated when an IPsec Phase-1 IKE Tunnel becomes inactive for peer %parm[peerRemoteAddr]%</descr> <logmsg dest="logndisplay">Cisco Event: IPSEC Phase-1 IKE Tunnel inactive for peer %parm[peerRemoteAddr]%</logmsg> <severity>Warning</severity> <parameter name="peerLocalAddr" value="%parm[#1]%" expand="true"/> <parameter name="peerRemoteAddr" value="%parm[#2]%" expand="true"/> <parameter name="tunnelId" value="%parm[name-#3.-1]%" expand="true"/> <alarm-data reduction-key="%uei%:%dpname%:%nodeid%:%parm[peerLocalAddr]%:%parm[peerRemoteAddr]%:%parm[tunnelId]%" alarm-type="1" auto-clean="false"> <managed-object type="vpn-tunnel"/> </alarm-data> </event>
And, the original definitions are still not displayed.
I don't know if there are repercussions or now because of this. Probably not in terms of behavior, but I'm wondering about the algorithm to find event definitions. That because if this process is repeated for multiple definitions, that will exponentially increase the number of definitions kept in memory and could have side effects on the time invested in processing events before sending them to the Event Bus.