4.5.9 Suppressing the forwarding of a large number of events

(1) Suppressing the event forwarding from agents by an operation from the manager

You can suppress the event forwarding from an agent where a large number of events have occurred by an operation from the manager. To achieve this, use the event forwarding suppression command (jevagtfw command) of JP1/Base. Specify the host name of the suppression-target agent in a parameter of the jevagtfw command, and execute the command from the manager. You can thus suppress the event forwarding from the suppression-target agent. Also, the JP1 events that are forwarded from the suppression-target agent can be discarded by the event server of the manager.

This functionality enables the manager to control the event forwarding from agents. Therefore, you can quickly take a measure, from the manager, against the occurrence of a large number of events on an agent.

Figure 4‒71: Overview of the operation of the jevagtfw command

To use this functionality, the JP1/Base on the manager host must be version 10-50 or later. Also the JP1/Base on the suppression-target agent host must be version 08-00 or later.

For details about the event transfer suppression command (jevagtfw command), see the chapter for commands and the chapter describing the suppression of event forwarding by the jevagtfw command in the JP1/Base User's Guide.

To Page Top

(2) Stopping the log file traps that output a large number of events by an operation from the manager

When a log file trap has issued a large number of JP1 events, you can stop the log file trap by an operation from the manager. You can use IM Configuration Management to stop individual log file traps on an agent from the manager. By using IM Configuration Management, you can stop the process of the suppression-target log file trap by an operation in the Display/Edit Profiles window for the relevant host.

ID and log file trap name of a log file trap

When JP1/Base on the agent host is version 10-50 or later, the ID number and log file trap name of a log file trap are added to the attributes of the JP1 events issued by that log file trap. (The log file trap name is added only if it was set when the log file trap was started.)

When JP1/Base of the manager is version 10-50 or later, the ID number and log file trap name of the log file trap are added to the attributes of the JP1 events issued by the remote-monitoring log file trap.

The added ID number and log file trap name of the log file trap are displayed as event attributes in the Event Details window when JP1/IM - Manager on the manager host is version 10-50 or later. Because you can identify the log file trap that is the source of a JP1 event with the attribute information of the JP1 event, you can quickly know the log file trap to be stopped.

Note

You can stop a log file trap on an agent from the manager also by executing the jevlogstop command with the ID number or log file trap name of the log file trap specified in the Execute Command window. For details about the jevlogstop command, see the chapter for commands in the JP1/Base User's Guide.

In the case of the remote-monitoring log file trap, to stop a log file trap, execute the jcfallogstop command with the monitored host name and the log file trap name of the log file trap specified. For details about the jcfallogstop command, see jcfallogstop in 1. Commands in the manual JP1/Integrated Management 2 - Manager Command, Definition File and API Reference.

To Page Top

(3) Setting a threshold for automatically suppressing the event forwarding from agents

When you set, in advance, a threshold for determining whether a large number of events occur, event forwarding can be suppressed automatically if a large number of events occur on an agent.

For the event server of agents, set an event forwarding suppression condition, which corresponds to the threshold for the suppression of monitoring of a large number of events. The event forwarding suppression condition specifies, for example, that event forwarding must be suppressed if issuance of at least 50 events within 5 seconds has occurred three times successively.

Setting an expected condition for the occurrence of a large number of events as the event forwarding suppression condition prevents the forwarding of a large number of events from agents.

Figure 4‒72: Overview of event forwarding suppression using a threshold

To use this functionality, JP1/Base on the suppression-target agent host must be version 10-50 or later.

For details about the event forwarding suppression using a threshold, see the chapter describing the event forwarding suppression using a threshold in the JP1/Base User's Guide.

To Page Top