During probe rules processing, the OMi tokens involved in event correlation and deduplication must be present in every iteration.
OprEvent object has
all the tokens required in the rules computation. However, an
never contains all the tokens, and so the probe must request from
OMi the full message (
OprEvent object) of the original
alert for each
OprEventChange object. The HTTP operation
would amount to substantial overhead if too frequently occur. To minimize
the processing overhead, the probe stores the selected fields from
OprEvent object in the Event Cache for future
reference to complement each
For the probe to manage the Event Cache using the following example configuration, specify the file holding these values in the EventCacheConfig probe property.
Field with default value
The maximum number of nodes in the cache.
The number of retry to request
The interval of an in-waiting event node.
The interval of an
To extend node duration if the node ever receives update.
The selected fields from
without a cached
OprEvent node for reference, it
enters the Event Cache as an in-waiting event node anticipating the
full message returned from the probe’s request to the OMi.
- If the full message is not obtained within the interval of
MSG_WAIT_TIMEOUT, then the node is removed and the
OprEventChangeis sent to the probe rules as a discarded event as with a
- If the full message is obtained within the interval of
MSG_WAIT_TIMEOUT, then the in-waiting node becomes an
OprEventnode with a full
To maintain data consistency of the
in the cache, whenever encountering its corresponding
the cached fields common to the object’s fields will get the
update. In return, the
OprEventChange is complemented
with the cached data, and assigned an additional
for the probe rules processing.
will be removed when its stay in the cache has reached the interval
on, a node’s duration will be extended with
the moment of each update.
When the Event Cache is full, the
probe resorts to requesting full messages upon
without the corresponding cached
OprEvent. It is
important not to configure
NODE_DURATION too large
MAX_NODES too small. The longer a node to stay
in the cache, the remaining free space will diminish in a higher rate
as there is growth of new nodes.
Event Cache data is not written to or read from a persistent file, the data will disappear after the probe shuts down as there is no practical purpose to keep a backup.
event correlation and deduplication are determined by
ObjectServer alerts.status table, which OMi fields to be cached must
be consistent with the fields that are used in the probe rules to