Controlling duplicate events
Use the event filtering and summarization options to control how duplicate events are sent to Tivoli® Monitoring.
Before you begin
About this task
The Agent Builder defines attribute groups that represent event data as pure event in Tivoli Monitoring. These attribute groups include log file, AIX® Binary Log, SNMP events, and JMX notifications. These attribute groups can produce multiple duplicate events. You can control how these duplicate events are sent to Tivoli Monitoring. You can activate these controls for log file, SNMP events, and JMX notifications attribute groups in the Event Information tab under Advanced Data Source Properties in the Advanced window.
Whether
an event is treated as a duplicate of other events is determined by
the key attributes, you define in the attribute group. A duplicate
event occurs when the values for all key attributes in the event match
the values for the same key attributes in an existing event. When event filtering and
summarization is enabled, the attributes for the isSummary, occurrenceCount, summaryInterval,
and eventThreshold functions are added automatically.
Procedure
- No event filtering or summarization: Sends all events without any event filtering or summarization. This option is the default option.
- Filter and summarize events:
Creates a summary record for each event with duplicates and each unique
event that is based on the key attributes. Select also to choose the event filtering option.
In the Summarization Options area,
enter the summary interval. You can enter either a value in seconds
or insert a configuration property. The event filtering options are:
- Only send summary events: Sends only the summary records for the specified interval.
- Send all events: Sends all events and summary records.
- Send first event: For each event, sends only the first event that is received in the summary interval that is specified and no duplicate events. This option also sends the summary records.
- Event threshold: Sends an event to Tivoli Monitoring when the number of duplicate events that are received in the interval is evenly divisible by the threshold. For example, if you set the event threshold to 5 and you receive less than five duplicates (including the first event) in the interval, no event is sent to Tivoli Monitoring. If you receive 5, 6, 7, 8, or 9 duplicates, one event is sent. If you receive 10 duplicates, 2 events are sent. In the Event threshold field, you can enter a number or insert a configuration property. This option also sends the summary records.