EMS Manual

Filter Tables and Burst Filters
EMS Manual—426909-005
6-10
Burst Filters
Table 6-2. Burst Filter Directives
Filter Directive Represents
?SUPPRESS The filter is a burst filter. This directive is required and must precede all
other burst filter configuration directives.
?N m The number of similar events repeated within T1 seconds that constitute
a burst condition. The variable must be in the range of 2 through 32,767
events. The default value is 100.
?T1 time The time interval during which similar events are counted to determine if
a burst has occurred. The variable time is given in seconds and must be
in the range of 1 through 3,600 seconds. The default value is 120
seconds.
?T2 time The time interval during which a bursting event must occur at least once.
Otherwise, the burst is considered to have ended. The variable time is
provided in seconds and must be in the range of 1 through 3600
seconds. The default value is 120 seconds.
?T3 time The time interval chosen for periodic checking of burst end conditions.
The timer starts when the first burst condition is detected and cancels
when there are no more burst conditions to monitor. The variable time is
given in seconds and must be in the range of 15 through 3600 seconds.
The default value is 300 seconds.
?S m The number of simultaneous bursts that can be monitored and the size of
the burst table. The variable m must be in the range of 2 through 128
bursts. The default value is 6 bursts. The larger the value that is chosen
for S, the higher the probability that event bursts will be detected, but at
the expense of increased processing time duration and table size.
?L m The length, in bytes, of the subject value that is used to determine if
events are similar. The variable m must be in the range of -1 through 254
bytes (the default value is 254 bytes). If set to -1, subject token and value
are not considered in the determination of similar events. Only the event
number and subsystem ID are used in the comparison. If set to zero, the
subject token ID is compared, but the value is not. The value chosen for
L impacts the size of the burst table.