EMS Manual

Filter Tables and Burst Filters
EMS Manual—426909-005
6-8
Burst Filters
filter directives in an EDIT file. The collector or distributor converts this EDIT file to a
filter object in the same manner as for standard filter tables.
A burst filter always acts like a FAIL filter because it suppresses event bursts that
conform to the prevailing BDS configuration criteria. When BDS is enabled in a
collector, these suppressed events are discarded rather than logged to disk. When
BDS is enabled in a distributor, suppressed events are discarded instead of being sent
to their normal destination devices.
A burst filter is identified with the directive ?SUPPRESS and can contain only burst
configuration parameters. Event header token directives and filter table entries are not
accepted. After a burst filter has been loaded into a collector or distributor, the event
stream is monitored, with event bursts detected and suppressed on the basis of the
burst filter’s configuration parameters.
To disable BDS in a collector or distributor, delete the burst filter, either through the
appropriate EMS program (EMSCCTRL for a collector) or by issuing a SPI DELETE
command with the burst filter object specified. To change burst parameters, delete the
burst filter and then add a new burst filter containing the altered BDS parameters.
You can install only one burst filter in a collector or distributor. However, you can
combine it with filter tables or compiled filters. If another filter precedes the burst filter,
only events not selected by the first filter are processed by the burst filter. However, if a
burst filter is followed by another filter, bursting events (as defined and suppressed by
the burst filter) are not sent to the second filter, and only nonbursting events are
passed on.
When an event burst is detected, any subsequent event that matches the burst
configuration criteria is suppressed until the burst ends. When the burst is detected,
the collector or distributor generates a burst-detected event that describes the bursting
event. The burst-detected event notifies operators that EMS has begun suppressing an
event and that they should not interpret the absence of further copies of the event as
an indication that the underlying problem has been corrected.
When the collector or distributor determines that a particular event burst has ended, it
generates a burst-ended event to notify operators that the underlying problem might
have been corrected and that normal processing of the event has once again been
enabled. The burst-ended event also identifies the number of events that were
suppressed.
Note. The distributor STATUS command does not provide any specific information about the
burst filter, nor does it provide any statistics counters. The EMSCINFO DETAIL display can
provide this information for primary and alternate collectors.
Note. By default, burst-detected and burst-ended events are sent to $0. However, you can
specify that the events be sent to an alternate collector and that they be logged in the TMDS or
TSM log. For more information, see BDS Parameters
on page 7-3.