EMS Manual

EMS Usage Best Practices and Recommendations
EMS Manual—426909-005
D-2
Event Content Guidelines

System configuration changes; e.g., path switches, takeovers, capacity changes,
threshold changes.

Threshold crossings; e.g., usage of a resource crossed a 70% threshold, capacity
of a device exceeded 1000 transfers per second.

Other conditions that could affect the stability or performance of your system; e.g.,
security violations or attacks, unusual conditions that may require future action,
frequent occurrence of recoverable errors.

Occurrences and anomalies that may lead to more serious problems. These
events could be useful in diagnosis should the more serious problem occur. You
should report these events judiciously; i.e., don’t flood the event log.
EMS-CON-111: Events should be atomic. An event should report a single occurrence
of a change of an object or subsystem. A single occurrence should not be reported in
more than one event. Examples:

If a service goes down, this should be reported in a single event. Having every
client of the service reporting the same event would flood the EMS log with
redundant information. However, each client could report an event that describes
how the service being down affected it.

If a device is reconfigured, put all the information of this occurrence in a single
event.
EMS-CON-121: Events that are not useful to the operator or support, that will clutter
the event log, or displace severe events, should not be reported. Below are some
examples:

Status or informational events that require no action. Occasional status or
informational events (say once a day) are permissible if they have an audience.

Repetitive events; e.g., one event for a down device is enough. It should not be
repeated until the device is up and goes down again. If rapid state change
oscillations or threshold crossings are possible, event dampening strategies such
as event burst suppression or threshold hysteresis should be employed in the
event creating module itself, rather than being dependent on the EMS burst
suppression.

Trace or debug events. Instead, files should be used for tracing and debugging
information.