EMS Manual

Burst Detection and Suppression
EMS Manual—426909-005
7-2
BDS Features
This strategy, referred to here as specific-event suppression, requires the use of a filter
table or compiled filter that clearly identifies the specific event type to be suppressed.
Pre-log filtration (PLF) refers to the use of one or more filters in a primary or alternate
collector to prevent certain events from being sent from the collector to its log file. This
includes at most one burst filter to suppress event bursts and one or more filter tables
or compiled filters that suppress some or all occurrences of specific event messages.
Suppressed events are discarded.
BDS Features
The EMS burst detection and suppression (BDS) feature lets system operators
manage burst events in primary collector, alternate collector, and distributor processes.
An event burst occurs when a similar event is issued repeatedly. For a definition of
similar events, see BDS Parameters on page 7-3.
In most instances, the initial event message in the burst provides sufficient notification
to the operator, and subsequent bursts of the same event message waste valuable
disk space and system resources. As with PLF, suppressed event bursts are
discarded.
In terms of burst filter and SUPPRESS directives, an event burst is the occurrence of N
similar events in T1 seconds, where N and T1 represent BDS parameter values that
you supply. An event burst is considered to have ended when the bursting event does
not occur for T2 seconds, where T2 is also a user-supplied parameter value.
When you apply BDS to an EMS collector (primary or alternate), you can prevent event
bursts of a specific size and duration from being written to the EMS log files. When an
event burst is detected, the collector suppresses logging of subsequent similar events
until the burst has ended. This saves the disk space and the system resources
required to write the redundant events to disk. The bursting events discarded by BDS
during burst suppression are eliminated from the system and are not available for
subsequent distribution or review.
When you apply BDS to an EMS distributor, the distributor discards redundant events
and does not pass them on to their destination devices or processes. Instead, these
events remain resident in EMS log files.
The monitoring and suppression of events by BDS is transparent to event users and
consumers. If the normal event stream does not contain frequent and repetitive events,
BDS is inactive from the perspective of event consumers. If you expect and want to
Caution. Use caution when using compiled filters or filter tables to totally suppress events that
are generated by subsystems that are specific to the NonStop server. Many of these events
are monitored by HP and other applications. Total event suppression can result in state
information from a particular subsystems for the NonStop server being discarded and
becoming nonretrievable. Because events from the subsystems specific to the NonStop server
are almost always sent to the primary collector ($0), you must use discretion in using such
filters in the primary collector when the suppressed event information might be of value to the
user.