'); $("#tabs").tabs({ selected: 1 }); $("#ic-homepage__ic-tips").append( quickTipHTML() ); unhideOneProductTip(); $("#ic-homepage__product-tips").wrapInner('
'); $("#ic-homepage__feed-tips").wrapInner('
'); });
IBM Tivoli Monitoring > Version 6.3 > User's Guides > Agent Builder User's Guide > Event filtering and summarization IBM Tivoli Monitoring, Version 6.3
View event filtering and summarization in the Tivoli Enterprise Portal
Examples of how data is treated depending on your event filtering and summarization choices.
The agent maintains a cache of the last events received. By default, this cache is 100 in size. If you enable agent event filtering and summarization, differences can occur between the number of events in the cache and the number sent to IBM Tivoli Monitoring. Additional events in the cache might not reach the designated threshold for sending. Or you might have fewer events in the cache if you selected the Send all events option. If the Send all events option is set, an event is sent each time a duplicate occurs. However, only one copy of the event is kept in the cache, and the occurrence count is incremented each time that the event occurs. To view the events that are sent to IBM Tivoli Monitoring, create a historical view. For information about creating historical views, see Historical Reporting. You can compare this view with the real-time cache view in the Tivoli Enterprise Portal. You can also use situations to make the same comparison.
The following examples indicate how the same log data is treated depending on your choice, if any, of event filtering and summarization. The example agent was created to illustrate different behaviors. Each attribute group was defined to monitor the same log file. In each example, a historical view and a real-time (cache) view is shown. The names of the nodes in the Tivoli Enterprise Portal reflect the settings selected. By default, the historical view displays the newest events last. The default real-time view of the cache displays the newest events first. In these examples, the historical view shows the last 1 hour.
As new events arrive, you can see them in the cache view. As duplicates of an event arrive, the data is updated in the existing row. When a summary interval elapses, the existing events are converted to summary events and sent. New rows are then added for the next summary interval.
(Figure 1) shows the historical view and cache view if you did not enable event filtering or summarization. Both views display the same data, but in reverse order. To display the corresponding events, the historical view is scrolled down and the real time (cache) view is scrolled up.
Figure 1. Historical view and cache view when event filtering or summarization is not enabled
(Figure 2) shows the historical view and cache view if you selected the Only send summary events option in the Event Information tab. The summary events are displayed in both views, but the new events are only displayed in the real-time (cache) view.
Figure 2. Historical view and cache view when Only send summary events is selected
(Figure 3) shows the historical view and cache view if you selected the Send all events option in the Event Information tab. All of the events are shown in both views, but you also see the summary events that are created at the end of each interval. The real-time view changes when the interval elapses. The existing events are converted into summary records and then the new events are added. The addition of the other two available event attributes that are used to display the summary interval (120 seconds in this example) and the SEND ALL threshold.
Figure 3. Historical view and cache view when Send all events is selected
(Figure 4) shows the historical view and cache view if you selected the Send first event option in the Event Information tab. The summary events are displayed in both views, but all the new events are only displayed in the real-time (cache) view. For each event, the historical view displays only the first event that is received in the interval and no duplicate events.
Figure 4. Historical view and cache view when Send first event is selected
(Figure 5) shows the historical view and cache view if you selected the Event threshold option and entered a value of 5. The summary events are displayed in both views, but all the new events are only displayed in the real-time (cache) view. In this example, a threshold of 5 is specified. The historical view displays an event only when five duplicates of an event (including the first event) are received in the interval. If less than 5 are received, no event is displayed. If 6, 7, 8, or 9 duplicates are received in the interval, one event is displayed. If 10 duplicates are received, 2 events are displayed.
Figure 5. Historical view and cache view when Event threshold is selected
Parent topic:
Event filtering and summarizationRelated concepts:
Event filtering and summarization