DeviceDown.conf?

[RSAAdmin]

Anyone using the devicedown.conf file and alert messageID 400029?  I'm trying to use it but the details are hairy.  The sparse documentation in the SP3 Release Notes give the file format.  But it does not indicate a way of entering comments or notes.  I'm finding that DEVICETYPE_TIMEOUT yields too many alerts and more specificity is required with DEVICE_TIMEOUT.  That's doable, but with a long list of IP addresses, it would be handy to be able to enter a comment so a year from now I know what machine that referrred to.  Anyone else?

[RSAAdmin]

We tried it out with DEVICEGROUP_TIMEOUT entries, but found it much too noisy for devices that don't log very much. Getting your timeouts right seems like the hard part. Adding 'ALERT_PERIOD 0' helps squelch repeated alerts for quiet devices.

Also note that DeviceGroup_Timeout entries can not have spaces in them, so if you've already got a group named "Cisco Switches" you'll need to recreate it as "Cisco_Switches" or something similar before you can use it with DeviceDown.conf.

[RSAAdmin]

Noted... essentially, this is a good idea that needs some further work from RSA. Thanks...

[PatricioDemarch]

Hi all. I am experimenting with devicedown.conf file to set timeouts for different device type. I ran into the problem of where to get the names of the types of devices to be specified in the variable DEVICETYPE_TIMEOUT. The documentation do not help about this.
I found the name to use on the the help of Supported Devices (Event Sources):
Here
 
Fourth column contains the name and ID. You must use the name.
 
An example of devicedown.conf
SYSTEM_TIMEOUT                                    60
POLLING_PERIOD                                     5
CONFIGURATION_PERIOD                        60
ALERT_PERIOD                                        0
DEVICETYPE_TIMEOUT    oracle               720
DEVICETYPE_TIMEOUT    openvms           480
DEVICETYPE_TIMEOUT    ibmmainframe   30
END

Patricio

[RSAAdmin]

I've been using this successfully for a couple of months now.  I just look at the most critical devices however (in my alert). 

If you have device groups setup for what you want to monitor for, just create a simple view that pulls the 400029 message and filters out the most important devices (domain controllers, firewalls, etc).  You use the Local Address field for this (laddr).  I then setup a supression of 24 hours (again based on laddr) so that I get notified once per day of what isnt sending to Envision.

I get the device names for the conf file from e:\nic\version\sitename\etc\devices