4.4.10 Suppressing repeated-event display by the consolidated display of repeated events
JP1/IM - View has a function to display the successively received JP1 events that have identical content in a consolidated form. This function is called consolidated display of repeated events. You cannot use this function when the suppression of repeated-event monitoring is enabled.
The consolidated display of repeated events can be set up by individual users.
Definitions of terms related to the consolidated display of repeated events
Some of the terms related to the consolidated display of repeated events are defined below. Note that, although the terms defined below include those used for the suppression of repeated-event display, their meanings might be different.
- consolidation start event
-
A consolidation start event is the first JP1 event JP1/IM - View receives among the JP1 events that have the same content.
- repeated event
-
A repeated event is a JP1 event that is received in succession after a consolidation start event and has the same content as the consolidation start event.
- consolidation event
-
A consolidation event is a consolidated group of a consolidation start event and repeated events. The consolidation event is classified into two types: event being consolidated, for which consolidation is being done, and consolidation completion event, for which consolidation has ended.
- non-consolidation event
-
A non-consolidation event is an event into which no events are consolidated because it has no corresponding repeated events.
Relationships among consolidated display of repeated events, filters, and other functions
The consolidation event resulting from the repeated events passes through the view filter or severe events filter in JP1/IM - View and appears on the Monitor Events page or Severe Events page of the Event Console window.
The following figure shows the relationships between consolidated display of repeated events and each of the JP1 event filters.
|
- Organization of this subsection
(1) Differences between the consolidated display of repeated events and the suppression of repeated-event display
At one time, you can only enable either the consolidated display of repeated events or the suppression of repeated-event display. The following table lists the differences between the consolidated display of repeated events and the suppression of repeated-event display.
Item |
Consolidated display of repeated events |
Suppression of repeated-event display |
---|---|---|
Consolidation target |
JP1 events that have the same content as the latest event |
JP1 events that meet the repeated event condition set by the user |
Suppression of automated action |
Unsupported |
Supported |
Consolidation of non-successive JP1 events |
Unsupported |
Supported |
(2) Conditions for starting event consolidation and ending event consolidation
JP1/IM - View performs event consolidation. The following describes the conditions for starting event consolidation and those for ending event consolidation:
- Conditions for starting event consolidation
-
Before starting event consolidation, JP1/IM - View regards the latest JP1 event received from JP1/IM - Manager as a temporary consolidation event. If the next JP1 event received has the same content as the temporary consolidation start event, JP1/IM - View determines the next JP1 event as a repeated event to be consolidated into a consolidation event, and starts consolidation.
- Conditions for ending event consolidation
-
Event consolidation ends when any of the following conditions is satisfied:
-
The contents of the received JP1 event do not match the consolidation start event.
-
The difference between the arrival times of the consolidation start event and received JP1 event exceeds the set timeout value.
-
The number of repeated events exceeds the maximum repeat count (100).
-
The user clicks the OK button in the Preferences window.
-
The event being consolidated was not defined as a severe event, but becomes so due to a change in the severe event definition.
-
The event being consolidated was defined as a severe event, but is no longer so due to a change in the severe event definition.
For details about the conditions for completing event consolidation, see 12.1.6 Considerations for consolidated display of repeated events.
-
(3) Event comparison attributes
On receipt of a new JP1 event, JP1/IM - View compares its contents with the consolidation start event, based on the attribute values of the JP1 event. If all attribute values match, the new JP1 event is judged to have the same contents as the consolidation start event.
JP1 event attributes consist of the following detailed information: Source host, event level, object type, object name, root object type, root object name, occurrence, user name, message, product name, action, type, and event ID. You cannot compare event contents based on specific JP1 event attributes only. If mapping of the event source hosts is enabled, the event source host name is added as an attribute. If you changed the event level of a JP1 event using the function for changing the severity level, the new event level applies when the JP1 event contents are compared.
(4) Example of processing to consolidate repeated events
The following figure shows an example of consolidation processing of repeated events.
|
The flow of processing described below, following the numbers in the figure:
-
JP1/IM - View receives JP1 event A1 and begins consolidation. JP1 event A1 becomes a consolidation start event.
Information about consolidation start event A1 appears in the Event Console window.
-
JP1/IM - View receives JP1 event A2 and compares its contents with the consolidation start event A1. Because A2 and A1 have identical contents, JP1 event A2 is judged to be a repeated event and is aggregated into A1.
Information about consolidation start event A1 and the repeat count (2) appears as A1[2] in the Event Console window.
-
JP1/IM - View receives JP1 event A3 and compares its contents with the consolidation start event A1. Because A3 and A1 have identical contents, JP1 event A3 is judged to be a repeated event and is aggregated into A1.
Information about consolidation start event A1 and the repeat count (3) appears as A1[3] in the Event Console window.
-
JP1/IM - View receives JP1 event B1 and compares its contents with the consolidation start event A1. Because B1 and A1 do not have identical contents, aggregation into consolidation start event A1 ends and aggregation into JP1 event B1 begins. Thus, B1 becomes the current consolidation start event.
Information about B1 and the previous consolidation event A1 appears in the Event Console window.
-
JP1/IM - View receives JP1 event B2 and compares its contents with the consolidation start event B1. Because B2 and B1 have identical contents, JP1 event B2 is judged to be a repeated event and is aggregated into B1.
Information about B1 and its repeat count (2), and about the previous consolidation event A1, appears in the Event Console window. (The former appears as B1[2].)
-
JP1/IM - View receives JP1 event A4 and compares its contents with the consolidation start event B1. Because A4 and B1 do not have identical contents, aggregation into consolidation start event B1 ends and aggregation into JP1 event A4 begins. Aggregation into the earlier consolidation start event A1 has already ended; therefore JP1 event A4 cannot be aggregated into A1. Thus, A4 becomes the new consolidation start event.
Information about the earlier event A1, previous event B1, and current consolidation event A4 appears in the Event Console window.