2.5.4 Setting a threshold to automatically suppress forwarding of large numbers of events

(1) JP1 events that are subject to suppression (threshold-based suppression of event-forwarding)

In threshold-based suppression of event-forwarding, JP1 events that are subject to the suppression are the ones forwarded according to the settings in the forwarding setting file (forward). Among the JP1 events filtered by the forward setting (to) in the forwarding setting file (forward), the system checks the number of JP1 events that match the destination of conditions for the suppression of event-forwarding and the event filter. If the number of matching JP1 events exceeds the threshold, event forwarding based on the forwarding setting file (forward) is suppressed.

Note that address-specified events and automatic forwarding events are not subject to suppression. For details on address-specified forwarding events and automatic forwarding events, see 2.5.3(1) JP1 events that are subject to suppression (event forwarding suppression by using the jevagtfw command).

To Page Top

(2) Event forwarding when multiple conditions for the suppression of event-forwarding are specified

You can specify two or more conditions for the suppression of event-forwarding in the forwarding setting file (forward). If you specify two or more conditions for the suppression of event-forwarding, the number of JP1 events is checked for each suppression condition. JP1 events that are judged not to be suppressed for all the suppression conditions are forwarded.

The following diagram shows the JP1 event forwarding when two or more conditions for the suppression of event-forwarding are specified.

To Page Top

(3) Detection and convergence of large numbers of events

The conditions for the suppression of event-forwarding have following setting items that represent JP1 event occurrence status to define large numbers of events: unit time, threshold, and check count. This section describes detection and convergence of large numbers of events based on the unit time, threshold, and check count.

The following table describes the setting items.

Detecting large numbers of events

If the number of JP1 events for a unit time exceeds the threshold successively for the number of times specified in the check count, the system determines that large numbers of events are detected, and suppress the event forwarding.

For example, suppose that you set 5 seconds for the unit time, 50 for the threshold, and 3 for check count. Event forwarding suppression starts when a condition in which 50 or more JP1 events occur within 5 seconds appears three times consecutively.

The following diagram shows the timing at when it is determined that an occurrence of large numbers of events is detected so that the event forwarding suppression is started, in relationship to the JP1 event occurrence status.

Figure 2‒28: Timing when event forwarding is suppressed

As shown in this diagram, if the check count is set to 3, the forwarding suppression starts at the time when the number of events exceeds the threshold for the first time during the third unit time.

Convergence of large numbers of events

While the event forwarding is suppressed, the system determines that large numbers of events have reached convergence, and then stops event forwarding suppression if the following condition exists:

- In the conditions for the suppression of event-forwarding, the number of JP1 events per unit time consecutively falls below the threshold the number of times specified as the check count.

For example, suppose that you set 5 seconds for the unit time, 50 for the threshold, and 3 for check count. Event forwarding suppression is stopped if the following condition is satisfied three times in succession: 49 or fewer JP1 events occur within 5 seconds.

The following diagram shows the timing at when it is determined that the large numbers of events has reached convergence so that the event forwarding suppression is stopped, in relationship to the JP1 event occurrence status.

Figure 2‒29: Timing when event forwarding suppression is stopped

To Page Top

(4) Transitions of forwarding status

The threshold-based suppression of event-forwarding has a forwarding status (either suppression stopped or suppressed) for each condition for the suppression of event-forwarding. The forwarding status transitions due to some causes.

The following diagram shows the relationship between the forwarding status transitions and their causes.

Forwarding status

• Suppression stopped

  This status does not suppress event forwarding.

• Suppressed

  This status suppresses event forwarding.

Causes

1. Startup

   Start up an event service (i.e. execute the jevstart command).

2. Detection of large numbers of events

   In the conditions for the suppression of event-forwarding, the number of JP1 events per unit time consecutively exceeds the threshold the number of times specified as the check count.

3. Convergence of large numbers of events

   In the conditions for the suppression of event-forwarding, the number of JP1 events per unit time consecutively falls below the threshold the number of times specified as the check count.

4. Reloading

   Reload the forwarding setting file (forward) (execute the jevreload command).

5. Stop

   Stop the event service (execute the jevstop command).

When the forwarding status transitions, a message and a JP1 event is output. The following table lists the messages and JP1 events output when the forwarding status transitions.

To Page Top

(5) Checking the forwarding suppression status

You can check the forwarding suppression status of JP1 events for each condition for the suppression of event-forwarding. To check the forwarding suppression status, use the jevfwstat command. For details, see jevfwstat in 15. Commands.

To Page Top

(6) Reporting the continuation of event forwarding suppression

You can periodically report that the event forwarding is suppressed by threshold-based suppression of event-forwarding to the manager. If an event forwarding suppression state lasts for a specified amount of time, the system issues the JP1 event (00003D0E) and the following message:

KAJP1086-W: Suppression of event-forwarding by host-name has continued for total-suppression-time seconds. (suppression ID = identifier)

The report can be enabled or disabled and the report interval can be specified in the event server settings file (conf). For details, see Event server settings file in 16. Definition Files.

To Page Top

(7) Notes on threshold-based suppression of event-forwarding

If you change the system date and time on the machine while the event server is running on the agent with threshold-based suppression of event-forwarding is set up, the forwarding status might incorrectly change. Alternatively, the continuation of event forwarding suppression might be erroneously reported.

The following describes the effect of changing the system date and time:

Effect when you move the system date and time ahead:

• Large numbers of events might be mistakenly evaluated as converged even when they are not, and event forwarding suppression might be stopped.

• The continuation of event forwarding suppression might be reported even when the suppression status does not last for a specified time.

Effect when you move the system date and time back:

• Large numbers of events might be mistakenly evaluated as occurred even when they are not, and event forwarding might be suppressed.

• The continuation of event forwarding suppression might not be reported even when the suppression status lasts for a specified time.

To Page Top