Setting thresholds based on message rates

The Message Rate Monitoring function measures the message rate for all messages that are subject to control by Message Flood Automation. The suggested thresholds provided in message CNZZ043I in response to a DISPLAY MSGFLD,MSGRATE command are good values to start with.

Set your REGULAR message threshold (MSGTHRESH) value based on the suggested thresholds in the CNZZ043I message. IBM® recommends that you use the 99% threshold value, but you may want to set the MSGTHRESH value higher.
Inter-message time is the inverse of message rate: a message rate of 2.0 messages/second means that messages arrive on average every 0.5 seconds (so the inter-message time is 0.5 second). You should set your REGULAR message inter-message time (SYSIMTIME) at or slightly above the inverse of the REGULAR MSGTHRESH value (1/MSGTHRESH). For example, if the REGULAR MSGTHRESH value is set to 25, you should set the REGULAR message inter-message time (SYSIMTIME) value to 0.04 (1/25) or slightly higher.

The REGULAR JOB message threshold (JOBTHRESH) must be set to a value less than that of MSGTHRESH. A JOBTHRESH value that is 30-40% of MSGTHRESH is a good starting point. This will allow you to handle 2-3 message flooding jobs simultaneously. A general "Rule of Thumb" is to take the MSGTHRESH value and divide by the number of jobs (less than 128) that you want Message Flood Automation to be able to handle simultaneously and use the result as the JOBTHRESH value.
The message rate for ACTION messages is typically a small fraction of REGULAR messages, so your ACTION message threshold (MSGTHRESH) can be less than your REGULAR message threshold. (Setting the ACTION threshold lower than the REGULAR threshold does not increase your overhead because the ACTION messages occur less frequently.) Because the ACTION message rate is lower, the ACTION inter-message time (SYSIMTIME) can be greater than your REGULAR message inter-message time.
The ACTION JOB message threshold (JOBTHRESH) must be set to a value less than that of MSGTHRESH. A JOBTHRESH value that is 30-40% of MSGTHRESH is a good starting point. This will allow you to handle 2-3 message flooding jobs simultaneously. A general "Rule of Thumb" is to take the MSGTHRESH value and divide by the number of jobs (less than 128) that you want Message Flood Automation to be able to handle simultaneously and use the result as the JOBTHRESH value.
Unless you have chosen very common messages, the message rate for SPECIFIC messages is typically a small fraction of REGULAR messages, so your SPECIFIC message threshold (MSGTHRESH) can be less than your REGULAR message threshold. Because the SPECIFIC message rate is lower, the SPECIFIC inter-message time (SYSIMTIME) can be greater than your REGULAR message inter-message times.
The SPECIFIC MSG message threshold (MSGLIMIT) must be set to a value less than that of MSGTHRESH. A MSGLIMIT value that is 15-20% of MSGTHRESH is a good starting point. This will allow you to handle 5-6 SPECIFIC message flooding messages simultaneously. A general "Rule of Thumb" is to take the MSGTHRESH value and divide by the number of messages (less than 1024) that you want Message Flood Automation to be able to handle simultaneously and use the result as the MSGLIMIT value.

The message rate specified by a threshold is also a function of the interval over which the threshold number of messages occurs. You can specify the same message rate through different combinations of the threshold and interval values. For example, setting MSGTHRESH=50 and INTVLTIME=1 specifies a message rate of 50 messages / second. Setting MSGTHRESH=100 and INTVLTIME=2 also specifies a message rate of 50 minutes / second. You may wish to choose which way you specify the message rates to achieve other goals:

Using the MSGTHRESH=50 and INTVLTIME=1 specification will make Message Flood Automation more responsive to detecting message flooding situations because only 50 messages will be counted between computations of the message rate; however, the overhead of the message rate computation will be incurred twice as frequently as the MSGTHRESH=100 and INTVLTIME=2 specification.
Using the MSGTHRESH=100 and INTVLTIME=2 specification will make Message Flood Automation less responsive to detecting message flooding situations because 100 messages will be counted between computations of the message rate; however, the overhead of the message rate computation will be incurred half as frequently as the MSGTHRESH=50 and INTVLTIME=1 specification.

You can use different combinations of threshold and interval to trade-off message flood detection responsiveness and message flood detection overhead.

The general idea is to set the various thresholds high enough that they are not being triggered by normal fluctuations in message rates but are triggered when sudden, very high message rates are encountered. For REGULAR messages, using one of the suggested threshold values provided by the CNZZ043I message is a good first approximation. You should set your thresholds high enough that Message Flood Automation is not constantly oscillating into and out of intensive mode. Receiving message CNZZ001I is usually a good indication that you have set the REGULAR message threshold too low; receiving message CNZZ019I is usually a good indication that you have set the ACTION message threshold too low.