Suppressing duplicate events is controlled using the Duplicate Events Suppression Settings in the Operations Management Infrastructure Settings.
To access:
1) Open a BSM GUI.
2) Navigate to Admin -> Infrastructure settings;
3) Select Operations Management in the Applications drop-down menu;
4) Scroll down to access the Operations Management – Duplicate Events Suppression Settings.
If duplicate event suppression is enabled, new events that are duplicates of an existing event are not retained and the original event is updated. If the new event includes a key, such as Select CI, a search is made for an existing, active event that has the same key value, in this case the same CI, as the new event. When a duplicate is identified, the timestamp for the original event is updated to the time when the duplicate was received.
Events must usually be received relatively soon after the original event to be regarded as a possible duplicate. This time period is also a configurable setting.
If the new event does not include a key, a search is made for an existing, active event where a set of configurable attributes has the same values as the new event.
If no original event is found yet, and the new event has a value for an HI, a search is made for an existing, active event that has the same ETI value and the same CI.
If the original event is found, the new event is excluded from any further processing and not added to the Event Browser. The original event is updated with information from the new event. The updates include the following information:
1) Duplicate count is increased by 1;
2) Received time is changed to that of the new event
Optionally, the following updates can also be made:
1) Change title to that of new event
2) Change severity to one of the following states:
a) Value contained in the new event;
b) Most critical value from the new and original severity
Duplicate matching operates as follows:
- If the new event has the No Duplicate Suppression flag set, no search for an original event is made.
- If the new event includes a key, a search is made for an existing, active event that has the same key as the new event, and that are separated by less than the time period specified in the Maximum Age of Duplicate Events setting.
- If the new event does not include a key, a search is made for an existing, active event where a set of configurable attributes have the same values as the new event, and that are separated by less than the time period specified in the Maximum Age of Duplicate Events setting.
- If no original event is found yet, and the new event has an ETI value for a health-contributing ETI, a search is made for an existing, active event that has the same ETI value and the same CI, and that are separated by less than the time period specified in the Maximum Age of Duplicate Events.
You can configure all the attributes you require to be taken into consideration in the course of event de-/duplication process under Operations Management – Duplicate Events Suppression Settings.
You can also specify the maximum number of duplicates setting Maximum Age of Duplicate Events attribute.
Close Related Event Settings
A new event can be used to automatically close one or more existing, related events. When a new event is received, a search for existing, related events is made. In this case, if any related events are found (c), these are closed and replaced by the new event.
There are two ways in which events can be related:
1) closeKeyPattern attribute
If an event comes in and its closeKeyPattern matches the key attribute of an existing event, the older event is closed.
2) ETIs Contributing to Health
Events can be related when they all contain an ETI contributing to health.
The value of the ETI of the new event must be different from the value of the existing, active events, but must be associated with the same CI.
Set Detected Related Events by Key Matching Pattern to use key attribute when determining if events are related.
Set Detected Related Events by ETI to make OMi to consider HIs values when determining related events.
To access this setting:
1) Open a BSM GUI.
2) Navigate to Admin -> Infrastructure settings;
3) Select Operations Management in the Applications drop-down menu;
4) Scroll down to access the Operations Management – Close Related Events Settings.
0 Comments