14.1.5 Considerations for suppressing the monitoring of repeated events and a large number of events

(1) Considering the purpose of using the suppression of repeated-event monitoring

The suppression of repeated-event monitoring is used for one of the following purposes:

1. Suppressing display of the events, in the event list, that do not need to be monitored and execution of the automated actions triggered by those events

2. Suppressing display of the events, in the event list, that have occurred in large numbers and execution of the automated actions triggered by those events

The suppression of repeated-event monitoring applies only to the events JP1/IM - Manager has acquired from the event service. This suppression function cannot prevent the increase of manager load caused when agents forward a large number of events to the manager. Therefore, when you use the suppression of repeated-event monitoring for purpose 2 described above, consider also the suppression of forwarding of a large number of events by JP1/Base.

For the suppression of forwarding of a large number of events by JP1/Base, see 14.1.7 Considerations for suppressing the forwarding of a large number of events.

To Page Top

(2) Considering the repeated event condition

Consider the repeated event condition according to the purpose of using the suppression of repeated-event monitoring. The following describes two examples of situations requiring setting of the repeated event condition:

Repeated event condition example 1: Suppressing display of events in the event list that do not need to be monitored and execution of the automated actions triggered by those events

To suppress display of the events in the event list that do not need to be monitored during daily monitoring operation and execution of the automated actions triggered by those events, set a repeated event condition without a threshold.

Table 14‒3: Example of repeated event condition for suppressing display of the events in the event list that do not specially need to be monitored and execution of the automated actions triggered by those events

Page in the Repeated Event Condition Settings window	Setting item	Setting
--	Repeated event condition name	Repeated event condition example 1
	Comment	Suppress display of the events, in the event list, that do not need to be monitored and execution of the automated actions triggered by those events.
Basic Settings page	Event conditions	Attribute name: Source host Attribute value: host1 Condition: Match Attribute name: Severity level Attribute value: Warning Condition: Match Attribute name: Object type Attribute value: LOGFILE Condition: Match
	Suppression items	Suppress display of the repeated events list Select the check box to enable. Suppress actions for the following events Select the check box to enable. (Select Repeated events other than repeated start events.)
Options page	Conditions for same attribute values	No setting
	Threshold	Clear the Enable check box.
	End monitoring period	3,600 seconds
	Suppression start event	Clear the Issue check box.
	Suppression end event	Clear the Issue check box.
	Checks for suppression to continue	Select the Enable check box. (Select Number of events for Timing of checks to decide whether suppression will continue, and specify 100 [events] as the interval of checking.)
	Processing for when suppression continues	Select Terminate suppression. (Clear the Issue an event to notify that suppression will be terminated check box.)

Explanation of repeated event condition example 1

Repeated event condition example 1 is a repeated event condition to suppress display of the log file traps, in the event list, whose source host is host1 and severity is Warning, and suppress the automated actions triggered by them. Automated actions are executed only when triggered by the repeated start event, but are not executed because of other repeated events.

During the period after JP1/IM - Manager receives the first repeated start event until monitoring suppression ends, monitoring suppression for the repeated events that meet this repeated event condition is terminated every time 100 events is received. The repeated event received immediately after monitoring suppression is terminated is treated as a repeated start event. Therefore, a preset automated action is executed every time monitoring suppression is terminated.

Monitoring suppression ends when one hour has passed since the last repeated event meeting this repeated event condition was received.

For the monitoring suppression without using a threshold, see the following reference:

About monitoring suppression without a threshold

• Suppressing the display of the events that meet the repeated event condition in the event list

  See 4.4 Suppressing display of repeated events.

• Repeated event condition without a threshold

  See 4.4.3 Repeated event conditions.

• Suppressing the execution of automated actions triggered by the events that meet the repeated event condition

  See 4.5.8 Suppressing the execution of automated actions and response actions triggered by a large number of events.

Repeated event condition example 2: Preparing for occurrence of a large number of events

If events occur in large numbers for any reason, their monitoring needs to be suppressed even though the events need to be monitored during daily monitoring operation. If you have ever experienced the occurrence of a large number of events during monitoring operation, set a repeated event condition with a threshold to prepare for a similar occurrence of a large number of events.

Table 14‒4: Example of repeated event condition to prepare for occurrence of a large number of events

Page in the Repeated Event Condition Settings window	Setting item	Setting
--	Repeated event condition name	Repeated event condition example 2
	Comment	Prepare for occurrence of a large number of events.
Basic Settings page	Event conditions	Attribute name: Source host Attribute value: hostA Condition: Match Attribute name: Severity level Attribute value: Error Condition: Match Attribute name: Object type Attribute value: LOGFILE Condition: Match
	Suppression items	Suppress display of the repeated events list Select the check box to enable. Suppress actions for the following events Select the check box to enable. (Select All repeated events.)
Options page	Conditions for same attribute values	No setting
	Threshold	Select the Enable check box. (100 events/30 seconds)
	End monitoring period	43,200 seconds
	Suppression start event	Select the Issue check box.
	Suppression end event	Select the Issue check box.
	Checks for suppression to continue	Select the Enable check box. (Select Number Time for Timing of checks to decide whether suppression will continue, and specify 3,600 (seconds) as the interval of checking.)
	Processing for when suppression continues	Select Issue an event to notify that suppression will continue.

Explanation of repeated event condition example 2

Repeated event condition example 2 is a repeated event condition to suppress display of the log file traps, in the event list, whose source host is hostA and severity is Error, and suppress the automated actions triggered by them. Execution of the automated action triggered by every event subject to monitoring suppression is suppressed. At the start and end of monitoring suppression, a JP1 event is issued for notification.

The events that meet the repeated event condition are assumed to be monitoring targets in normal monitoring operation. Therefore, their monitoring is suppressed only when more than 100 events occur within 30 seconds.

During the period after JP1/IM - Manager receives the first repeated start event until monitoring suppression ends, it issues the event to notify that suppression will continue every hour to notify that events continue to occur in large numbers.

Monitoring suppression ends when 12 hours has passed since a large number of events occurred (repeated events more than the threshold value per unit of time).

For the monitoring suppression with a threshold set, see the following reference:

About monitoring suppression with a threshold

• Suppressing the monitoring of a large number of events

  See 4.5 Suppressing monitoring of a large number of events.

• Repeated event condition without a threshold

  See 4.5.3 Repeated event condition for the suppression of monitoring of a large number of events.

• Suppressing the execution of automated actions triggered by a large number of events

  See 4.5.8 Suppressing the execution of automated actions and response actions triggered by a large number of events.

To Page Top