4.5.1 Mechanism of the suppression of monitoring of a large number of events
The suppression of monitoring of a large number of events is performed by JP1/IM - Manager, JP1/IM - View, and JP1/Base. The suppression of monitoring of a large number of events enables you to consolidate, on JP1/IM - View, the monitored events that hinder event monitoring in order to suppress the display of those individual events in the event list. The suppression of monitoring of a large number of events enables you also to suppress the execution of the automated actions that are triggered by those events. Monitoring of dummy events cannot be suppressed.
The following table describes the roles of JP1/IM - Manager, JP1/IM - View, and JP1/Base in the suppression of monitoring of a large number of events.
Product name |
Role of product |
---|---|
JP1/IM - Manager |
|
JP1/IM - View |
|
JP1/Base |
|
The following separately illustrates the roles of JP1/IM - Manager and JP1/Base in the mechanism of suppressing the monitoring of a large number of events:
Mechanism of suppressing the monitoring of a large number of events (JP1/IM - Manager)
JP1/IM - Manager suppresses the monitoring of a large number of events by treating them as repeated events.
JP1/IM - Manager acquires monitoring-target events (that have passed through the event acquisition filter) from the event service, and then compares them with a repeated event condition set by the user. In the repeated event condition, the user must set the event condition to determine whether to suppress events when they occur in large numbers and the threshold for determining whether the events have occurred in large numbers.
When a monitoring-target event meets the following conditions, JP1/IM - Manager determines that the acquired monitoring-target event is one of the events that have occurred in large numbers, and suppresses its monitoring.
-
The monitoring-target event meets the event condition set in the repeated event condition.
-
The number of monitoring-targets that have occurred exceeds the set threshold.
Figure 4‒54: Mechanism of suppressing the monitoring of a large number of events (JP1/IM - Manager)
Mechanism of suppressing the monitoring of a large number of events (JP1/Base)
When a large number of JP1 events have occurred, JP1/Base suppresses the forwarding of the JP1 events to the manager by using the forwarding setting file (forwarding filter) for the relevant agent.
|
The following table explains the differences between JP1/IM - Manager's repeated event monitoring suppression function and JP1/Base's event forwarding suppression function when a large number of JP1 events occur.
Comparison item |
JP1/IM - Manager's repeated event monitoring suppression function |
JP1/Base's event forwarding suppression function# |
---|---|---|
Handling of events |
Events are consolidated by the manager. |
Forwarding of events to the manager is suppressed. |
Monitoring of events |
Monitoring of events can be continued. |
Events for an agent whose event forwarding was suppressed can no longer be monitored. |
Suppressing monitoring of events that have occurred in large number (suppressing display of the events in the event list and suppressing execution of automated actions) |
Monitoring can be suppressed. |
Monitoring is not needed. |
Load on network traffic and manager hosts |
There are loads because events continue to be forwarded from agents. |
There is no load because event forwarding from agents is suppressed. |
Adding events to the manager host's event database |
Added |
Not added |
#: When forwarding of JP1 events is suppressed, the manager can no longer check important events that are issued by a corresponding agent and that might need to be monitored. To check events that occurred while forwarding was suppressed, you must use JP1/IM - View to search the corresponding agent's event database. For details, see 4.6 Searching for events.
Also, consider the settings for the JP1 events that will be transferred from JP1/Base to the manager and the manager's JP1 event filtering settings. For details about settings for the JP1 events that are transferred by JP1/Base, see 12.1.2 Considerations for forwarding JP1 events to managers. For details about the filtering settings on a manager, see 12.1.3 Considerations for filtering JP1 events.
For details about the JP1/Base function for suppressing forwarding of events, see the chapter that provides details of JP1/Base functions in the JP1/Base User's Guide.
- Organization of this subsection
(1) Relationships among the suppression of monitoring of a large number of events, filters, and other functions
After receiving a large number of events, JP1/IM - View filters them by its view or severe events filter, and then displays them as consolidation events on the Monitor Events or Severe Events page of its Event Console window. When the large number of events JP1/IM - Manager received are to trigger automated actions, JP1/IM - Manager suppress the execution of the automated actions according to the corresponding repeated event condition.
When the view filter is enabled, if the consolidation start event is filtered out by the view filter and not displayed in the Event Console window, no consolidation event is displayed.
When the restrictions on viewing and operating business groups are enabled, if the consolidation start event is not displayed on the Event Console window because of the restrictions, no consolidation event is displayed.
When the specification of event display period is enabled, the repeated events received within the specified period are displayed as consolidation events. If JP1/IM - View retains an event being consolidated outside the specified period and receives a repeated event within the specified period, the event being consolidated outside the specified period becomes a consolidation completion event. Then, the newly received repeated event becomes a consolidation start event.
The following figure shows the relationships among the suppression of monitoring of a large number of events, JP1 event filters, and other functions.
|