2.5.3 Using a manager to suppress event forwarding from an agent with large numbers of JP1 events

(1) JP1 events that are subject to suppression (event forwarding suppression by using the jevagtfw command)

When the jevagtfw command is used to suppress event forwarding, JP1 events that are subject to the suppression are forwarded according to the settings in the forwarding setting file (forward).

The following JP1 events are not subject to suppression:

• Address-specified forwarding events:

  Address-specified forwarding events include the following JP1 events:

  • JP1 events that are forwarded to a destination event server specified by the jevsend or jevsendd commands

  • JP1 events that are forwarded to a specific host by a program linking with an event service (for example, a JP1/AJS event-sending job) without using the forwarding setting file (forward).

• Automatic forwarding events:

  These are events that are forwarded even when they do not match the filtering conditions of the forwarding setting block specified in the forwarding setting file (forward).

  Automatically forwarded events include the following JP1 events:

  • Event reporting of JP1/Base startup (00004724)

  • Event reporting of JP1/Base shutdown (00004725)

  • Event reporting of a threshold-based suppression (00003D0B)

  • Event reporting of a stop of a threshold-based suppression (00003D0C)

  • Event reporting of a stop of all threshold-based suppressions (00003D0D)

  • Event reporting of the continuation of threshold-based suppressions (00003D0E)

  Note that if auto-forward-off flag is specified in the options parameter in the event server settings file (conf), the automatic forwarding events become subject to suppression in the same way as normal events.

To Page Top

(2) Setting up event forwarding suppression

Use the jevagtfw command with the -s option specified to set up event forwarding suppression in the event forwarding settings for a suppressed agent. Also specify settings to discard JP1 events forwarded from the suppressed agent, without storing the events in the event database of the manager.

The following diagram shows the process flow for setting up event forwarding suppression by using the jevagtfw command.

1. Execute the jevagtfw command with the -s option specified.

2. Specify settings to discard events received from a suppressed agent.

3. Back up the information in the forwarding setting file (forward) on the agent.

4. Send the forwarding setting file for event forwarding suppression (forward_suppress file or other forwarding suppression definition file) to the agent, and update the forwarding setting file (forward).^#1

5. Reload the updated forwarding setting file (forward) and apply it.^#2

6. Event forwarding is suppressed according to the forwarding setting file (forward).

#1: If sending the forwarding setting file for event forwarding suppression file (forward_suppress file or other forwarding suppression definition file) fails due to a communication error, the event forwarding suppression process is canceled. The status of the forwarding setting file (forward) on the agent remains unchanged from before the command is executed.

#2: If applying the updated forwarding setting file (forward) fails, send the backed up forwarding setting file (forward_backup) to the agent and apply (restore) it. If the restoration fails, the following message is output:

KAJP1434-E: Failed to restore the file forward to host-name. (file = file-name)

• Suppressing event forwarding

  Set up event forwarding suppression on an agent. This corresponds to steps 3 to 6 in Figure 2-26.

• Discarding received events

  Discards the JP1 events forwarded from a suppressed agent without storing the events in the event database of the manager. This corresponds to step 2 in Figure 2-26.

  JP1 events that are subject to discard

  JP1 events that are subject to discard are those that are forwarded according to the settings in the forwarding setting file (forward). Address-specified forwarding events and automatic forwarding events are not subject to discard. For details on address-specified forwarding events and automatic forwarding events, see (1) JP1 events that are subject to suppression (event forwarding suppression by using the jevagtfw command).

  A JP1 event forwarded via a submanager from an agent to the manager is also subject to discard, if the JP1 event is issued by a suppressed agent.

  Excluding a specific JP1 event from discarded events

  If you want to exclude a JP1 event from discarded events, define the undisposedids parameter in the event server settings file (conf) to exclude a specific JP1 event from being discarded.

  Note that even when a received event is discarded, the sender event server perceives the forwarding as successful.

To Page Top

(3) Stopping event forwarding suppression

You can execute the jevagtfw command with the -r option specified to stop event forwarding suppression on an agent. The following diagram shows the process flow for stopping event forwarding suppression by using the jevagtfw command.

1. Execute the jevagtfw command with the -r option specified.

2. Remove the setting to discard received events.

3. Compare the forwarding setting file (forward) on the agent and the forwarding setting file for event forwarding suppression (forward_suppress file or other forwarding suppression definition file) that was sent when the suppression was set up.

   If the result has a difference, cancel the stop process of event forwarding suppression.

4. Send the forwarding setting file (forward_backup) backed up when the suppression was set up to the agent, and update the forwarding setting file (forward).

5. Reload the updated forwarding setting file (forward) and apply it.

6. Event forwarding is restarted according to the forwarding setting file (forward).

If the settings in the forwarding setting file (forward) are changed while event forwarding is suppressed:

When event forwarding suppression is stopped, the system checks whether the settings in the forwarding setting file (forward) have been changed. If the settings in the forwarding setting file (forward) have been changed, the following error messages are output, and the stop process of event forwarding suppression is cancelled:

KAJP1415-E: The contents of the forward file for suppressing event-forwarding of host-name are different from those set at the time of suppression.
KAJP1432-E: An attempt to stop the suppression of event-forwarding from host-name failed.

In this case, either of the following measures is required:

• Forcibly stop event forwarding suppression (execute the jevagtfw command with the -r and -f options specified).

  If you can revert settings in the forwarding setting file (forward) to the settings before event forwarding suppression without problems, forcibly stop suppression.

• Stop event forwarding suppression only on the manager (execute the jevagtfw command with the -r and -m options specified).

  To continue using the settings that have been changed during the event forwarding suppression, stop event forwarding suppression only on the manager. The forwarding setting file (forward) on the agent will not revert back to the settings before the event forwarding suppression. In this case, to confirm that no necessary definitions are omitted, compare the settings with those in the forwarding setting file (forward_backup) backed up when the suppression was set up and kept in the manager.

To Page Top

(4) Checking event forwarding suppression status

You can execute the jevagtfw command with the -l option specified to check the suppressed status for each agent whose event forwarding is currently suppressed. The following information can be checked:

• Name of the agent host whose event forwarding is currently suppressed

• Time when the event forwarding suppression was started

• Status of discarding received events (whether the received events are set to be discarded)

• Status of event forwarding suppression (whether event forwarding is set to be suppressed)

To Page Top

(5) Reporting the continuation of event forwarding suppression

You can use the jevagtfw command to issue a JP1 event reporting that event forwarding is suppressed. If an event forwarding suppression state lasts for a specified amount of time, the system issues the JP1 event (00003D05) and the following message:

KAJP1087-W: Suppression of event-forwarding by the jevagtfw command has continued for total-suppression-time seconds. (server = host-name)

The report can be enabled or disabled and the report interval can be specified in the event server settings file (conf). For details, see Event server settings file in 16. Definition Files.

Effect of changing the system date and time

If you change the system date and time, reporting of the continuation of event forwarding suppression is affected as follows:

• If you move the system date and time ahead, reporting of the continuation of event forwarding suppression occurs at an interval shorter than the original setting.

• If you move the system date and time back, reporting of the continuation of event forwarding suppression delays.

To Page Top

(6) Files and directories used by event forwarding suppression using the jevagtfw command

In the case of the event forwarding suppression using the jevagtfw command, you use the manager to manage the forwarding setting file for event forwarding suppression (forward_suppress) and suppression information for each agent. This section describes files and directories used during the event forwarding suppression using the jevagtfw command.

Location:

The files and directories described above are stored under the directory specified by the event server index file (index) as with the event server settings file (conf) and the forwarding setting file (forward). The following describes the default locations:

In Windows:

installation-folder\conf\event\servers\default

In UNIX:

/etc/opt/jp1base/conf/event/servers/default

Structure of files and directories:

The following diagram shows the structure of files and directories used during the event forwarding suppression using the jevagtfw command.

Figure 2‒27: Structure of files and directories used during the event forwarding suppression using the jevagtfw command

Description on files and directories

The following table lists the files and directories used during the event forwarding suppression using the jevagtfw command.

Table 2‒4: List of files and directories used during the event forwarding suppression using the jevagtfw command

File or directory	Description
/suppress/forward_suppress	The forwarding setting file for event forwarding suppression. This file is sent to the agent when event forwarding suppression is set up. The following contents (comments) are set by default: # The manager has suppressed forwarding of events by this agent. # Check with the administrator of the manager before editing this file. The format is the same as the forwarding setting file (forward). For the format of the forwarding setting file (forward), see Forwarding settings file in 16. Definition Files.
/suppress/forward_suppress.model	The model file for the forwarding setting file for event forwarding suppression (forward_suppress).
/suppress/forwarding-suppression-definition-file-name	The forwarding suppression definition file optionally specified by a user. To specify a separate forwarding suppression setting for each agent, prepare a forwarding suppression definition file with a desired file name, and specify the file name using the -s option of the jevagtfw command.
/suppress/statdb.bin	A binary file that controls the suppression status.
/suppress/agent-host-name	A directory in which suppression status for each agent host is stored. This directory is created when event forwarding suppression is succeeded by using the jevagtfw command. This directory remains unless the user deleted it.
/suppress/agent-host-name/forward_suppress	This file contains the settings in the forwarding setting file for event forwarding suppression that was sent to the agent when the event forwarding suppression was set up. When you attempt to stop the event forwarding suppression, the system compares the contents of this file with the contents in the forwarding setting file on the agent.
/suppress/agent-host-name/forward_backup	This file contains backup information of the forwarding setting file obtained from the agent when the event forwarding suppression was set up. When you attempt to stop the event forwarding suppression, the contents of this file is set to the forwarding setting file on the agent again#.
/suppress/agent-host-name/log	The log file in which suppression of event forwarding and stopping of the suppression are recorded. If the log file exceeds 64 KB, the file name is changed to log.old, and a new log file is created.
/suppress/agent-host-name/log.old

#: If event forwarding suppression is set up, when the forwarding setting file on the agent is backed up, information beyond the 1,024th byte per line in the definition of the file is deleted as invalid. When the event forwarding suppression is stopped, the forwarding setting of which information beyond the 1,024th byte per line has been deleted is set in place. Therefore, definition information which was invalid because it exceeded 1,023 bytes per line might become valid because it is now within 1,023 bytes.

Use of machine-dependent characters

Do not use machine-dependent characters in the following files, including the comment lines:

• suppress/forward_suppress

• suppress/any-file-name

These files are sent to the agent when event forwarding suppression is set up. Use of machine-dependent characters might cause garbling or missing of characters. If garbling or missing of characters occurs, an attempt to stop event forwarding suppression might fail with an error (KAJP1415-E).

KAJP1415-E: The contents of the forward file for suppressing event-forwarding of host-name are different from those set at the time of suppression.

To Page Top