'); $("#tabs").tabs({ selected: 1 }); $("#ic-homepage__ic-tips").append( quickTipHTML() ); unhideOneProductTip(); $("#ic-homepage__product-tips").wrapInner('
'); $("#ic-homepage__feed-tips").wrapInner('
'); });
IBM Tivoli Monitoring > Version 6.3 > User's Guides > Agent Builder User's Guide > Event filtering and summarization IBM Tivoli Monitoring, Version 6.3
Control duplicate events
Use the event filtering and summarization options to control how duplicate events are sent to Tivoli Monitoring.
For more information about event filtering and summarization, see Event filtering and summarization.
The Agent Builder defines attribute groups that represent event data as pure event in Tivoli Monitoring. These attribute groups include log file, AIX Binary Log, SNMP events, and JMX notifications. These attribute groups can produce multiple duplicate events. You can control how these duplicate events are sent to Tivoli Monitoring. You can activate these controls for log file, SNMP events, and JMX notifications attribute groups in the Event Information tab under Advanced Data Source Properties in the Advanced window (Figure 1).
Whether an event is treated as a duplicate of other events is determined by the key attributes, you define in the attribute group. A duplicate event occurs when the values for all key attributes in the event match the values for the same key attributes in an existing event. When event filtering and summarization is enabled, the attributes for the isSummary, occurrenceCount, summaryInterval, and eventThreshold functions are added automatically.
Procedure
In the Event Filtering and Summarization Options area, select one of the following options:
- No event filtering or summarization: Sends all events without any event filtering or summarization. This option is the default option.
- Filter and summarize events: Creates a summary record for each event with duplicates and each unique event that is based on the key attributes. Select also to choose the event filtering option. In the Summarization Options area, enter the summary interval. You can enter either a value in seconds or insert a configuration property.
The event filtering options are:
- Only send summary events: Sends only the summary records for the specified interval.
- Send all events: Sends all events and summary records.
- Send first event: For each event, sends only the first event that is received in the summary interval that is specified and no duplicate events. This option also sends the summary records.
- Event threshold: Sends an event to Tivoli Monitoring when the number of duplicate events that are received in the interval is evenly divisible by the threshold. For example, if you set the event threshold to 5 and you receive less than five duplicates (including the first event) in the interval, no event is sent to Tivoli Monitoring. If you receive 5, 6, 7, 8, or 9 duplicates, one event is sent. If you receive 10 duplicates, 2 events are sent. In the Event threshold field, you can enter a number or insert a configuration property. This option also sends the summary records.
Figure 1. Advanced Data Source Properties page.
Parent topic:
Event filtering and summarization