EMS Manual

Burst Detection and Suppression
EMS Manual—426909-005
7-5
BDS Configuration Examples
the first event subject in the event burst. This burst-detected event alerts operators that
EMS has begun suppressing an event. Operators should not interpret the absence of
further copies of the event as an indication that the underlying problem has been
corrected.
When EMS determines that a burst has ended, it generates a burst-ended event to
notify operators that the underlying problem has been corrected and that normal
processing of the event has again been enabled. In addition to identifying the ended
burst, the burst-ended event also reports the number of redundant events that were
discarded by the EMS collector or distributor.
By default, the burst-detected and burst-ended events are sent to $0. However, you
can have these events sent instead to an alternate collector using a DEFINE:
add define =_ems_alternate_log, file $ACO
You can also log these events to the TMDS (D-series) or TSM Service Log (G-series):
add define =_ems_system_log, file $ZLOG
Because the EMS collector and distributor processes are active only when incoming
messages and events are received, they might need to be awakened periodically to
check for burst-ended conditions after an event burst has been detected. The user can
configure this wakeup period, the T3 parameter value.
BDS Configuration Examples
These examples illustrate two BDS configurations and their effect on event burst
detection and suppression.
Example 1
The primary collector, $0, is configured with BDS enabled, where N=10 events, T1=10
minutes, T2=5 minutes, and T3=1 minute. If a process began issuing the same event
at 30-second intervals beginning at exactly 10:00:

$0 continues to log the event until 10:05, when the eleventh copy of the bursting
event arrives. Because $0 has detected the event more than ten times in 10
minutes, $0 logs a burst-detected event. It does not log subsequent occurrences of
the event but instead discards them.

At 10:20:05, the offending process is stopped, so the last event in the burst was
issued at 10:20:00.

Some time between 10:25 and 10:26 (10:20 + 5 minutes + (0-1 minute)), $0 logs
an event declaring that the event burst has ended (burst-ended event).
Example 2
A system (node \ABC) is running SNAX with six lines (named $LINE1 through
$LINE6). Each line is configured with four physical units (PUs), named #PU1 through
#PU4. Each PU is configured with 32 LUs (named #LUn01 through #LUn32, where n