5.1.7 Suppressing event forwarding when a large numbers of events occur

(1) Suppressing, on the manager, event forwarding from an agent on which a large numbers of events occur

On the manager, you can suppress event forwarding from an agent, as an action to take when a large numbers of events occur on the agent.

In the procedure below, you can use the Event Console window to direct the manager host to execute a command. The following conditions are required to execute a command:

• A JP1 user who executes a command from JP1/IM - View is registered in the authentication server.

• The JP1 user who executes the command from JP1/IM - View has either of the following JP1 permissions:

  • JP1_Console_Admin

  • JP1_Console_Operator

• The system configuration is defined by using the JP1/Base configuration management.

• JP1 users and OS users are mapped on the manager host.

• OS users mapped with JP1 users have execute permission for the jevagtfw command on the manager host.

  For details about the jevagtfw command, see the chapter about commands in the Job Management Partner 1/Base User's Guide.

Before performing the procedure below, the Command button in the Event Details window must be enabled. For details about how to enable the Command button, see 1.16 Setting up a command execution environment in the Job Management Partner 1/Integrated Management - Manager Configuration Guide for Windows, or see 2.15 Setting up a command execution environment in the Job Management Partner 1/Integrated Management - Manager Configuration Guide for UNIX.

Also, mapping of the event source host must be enabled beforehand. For details about how to enable mapping of the event source host, see 4.12 Setting event source host mapping in the Job Management Partner 1/Integrated Management - Manager Configuration Guide.

To use the manager to suppress, event forwarding from an agent on which a large numbers of events occur:

1. In the events list in the Event Console window, make sure that a lot of JP1 events are output from a specific agent.

2. Display the Event Details window for the relevant JP1 event.

3. Make sure that an event source host name is displayed for Event attributes in the Event Details window.

4. In the Event Details window, click the Execute Command button.

   The Execute Command window appears.

5. In the Execute Command window, specify the jevagtfw command for Command. Specify the variable for the event source host as the argument.

   Example of the command:

   jevagtfw -s $EV"JP1_SOURCEHOST"

   Also, make sure that the setting items in the Execute Command window are set as follows:

   • Command of managed host is selected for Command type.

   • Inherit event information is selected for Event information to inherit.

   • The manager host name is set for Target host.

6. In the Execute Command window, click the Execute button.

   The Preview Command Execution Content window appears.

   Make sure that the contents of the command to be executed are correct.

7. In the Preview Command Execution Content window, click the Execute button to execute the jevagtfw command.

   Event forwarding from the specified agent is suppressed.

   You can check the execution result of the command in the Log area of the Execute Command window.

8. Identify why a large numbers of events are occurring, and then solve the problem.

   While event forwarding is suppressed, investigate the event source agent, and then solve the problem.

   Reference note

   You can also execute a command previously registered to the Command button in the Execute Command window. You can click the Command button to suppress event forwarding by previously registering the jevagtfw command to the button. For details about how to register a command to the Command button, see 7.1.2 Executing a command by using the Command button.

To Page Top

(2) Stopping, on the manager, a log file trap that issues a large numbers of events

The procedure below shows how to stop a specified log file trap, by using IM Configuration Management on the manager, as an action to take when a large numbers of events are issued by the log file trap.

Before performing the procedure below, IM Configuration Management must be used to manage the profile of the agent. For a general description of profile management by using IM Configuration Management, see 6.5 Profile management in the Job Management Partner 1/Integrated Management - Manager Overview and System Design Guide. For details about how to set the profile by using IM Configuration Management, see 3.5 Setting the profiles in the Job Management Partner 1/Integrated Management - Manager Configuration Guide.

Also, mapping of the event source host must also be enabled beforehand. For details about how to enable mapping of the event source host, see 4.12 Setting event source host mapping in the Job Management Partner 1/Integrated Management - Manager Configuration Guide.

1. In the events list in the Event Console window, make sure that a lot of JP1 events issued by a log file trap are output.

2. Display the Event Details window for the relevant JP1 event.

3. Make sure that the event source host name and monitoring name^# are displayed for Event attributes in the Event Details window.

   #

   To display the monitoring name of a log file trap for Event attributes in the Event Details window, JP1/IM - Manager must be version 10-50 or later, and JP1/Base on the agent must be version 10-50 or later.

4. Log in to the IM configuration management viewer (IM Configuration Management), and display the IM Configuration Management window.

5. Click the IM Configuration tab to display the IM Configuration page.

6. In the tree area, select the event source host name of the log file trap, and then select Display Profiles from the View menu.

   The Display/Edit Profiles window for the relevant host appears.

7. In the tree area, select JP1/Base, and then in the Edit menu, select Exclusive Editing Settings.

   Exclusive editing of the profile is permitted.

8. From Log File Trapping in the tree area, select the monitoring name of the log file trap to be suppressed, and then in the Operation menu, select Stop Process.

   A confirmation message is output, asking you whether to stop the log file trap.

9. Click the Yes button.

   The log file trap stops.

10. Identify why a lot of logs are occurring, and then solve the problem.

    While the log file trap is stopped, investigate the source application that output the logs, and then solve the problem.

To Page Top

(3) Automatically suppressing event forwarding from an agent by setting a threshold

To automatically suppress event forwarding by setting a threshold, in case a large numbers of events occur on an agent:

1. Edit the forwarding setting file on an agent on which event forwarding is to be automatically suppressed.

   Set the conditions for suppressing event forwarding (which is equivalent to the threshold of frequently occurring events) in the forwarding setting file of JP1/Base on the agent.

   Format of the condition for suppressing event forwarding:

   suppress ID unit-of-time threshold-value confirmation-count [destination(optional)]
   Event filter:
   end-suppress

   For details about the conditions for suppressing event forwarding, see the description of the forwarding setting file (forward) in the Job Management Partner 1/Base User's Guide.

2. Enable the changes in the forwarding setting file.

   Reloading the forwarding setting file or restarting the event service enables the new settings.

   If the event occurrence status matches the set conditions for suppressing event forwarding, event forwarding is suppressed.

   While event forwarding is suppressed, investigate the event source agent, and then solve the problem.

   If the problem is solved and the event occurrence status matches the conditions for cancelling suppression of event forwarding, event forwarding resumes automatically.

To Page Top