170 likes | 366 Views
Message Source Configuration: Message Conditions. Section Overview. Definition of Conditions Message condition Suppress condition Suppress unmatched condition Message Processing on the Managed Node Condition process flow Advanced Options Duplicate Message Suppression Timers intervals
E N D
Section Overview • Definition of Conditions • Message condition • Suppress condition • Suppress unmatched condition • Message Processing on the Managed Node • Condition process flow • Advanced Options • Duplicate Message Suppression • Timers intervals • Counters • Testing Conditions Message Source Configuration: Message Conditions
Message Condition Types Cannot Initiate new sessions “Original messages” from various sources Backup failed Disk Overflow Local Special Form Database table full Job Aborted Filters will remove“uninteresting messages” Suppress Unmatched Message Processingagainst the defined conditions Suppress Matched Match Condition creates an “VPO Message” Match Condition Message Source Configuration: Message Conditions
Message and Suppress Condition Window Use the “move” options to have the conditions checked before or after others List of suppress andmatch conditions Double-click conditionto edit Message Source Configuration: Message Conditions
Message Conditions Review • How to match an event • Matching Criteria • Pattern Matching • What to do if it matches • Suppress Unmatched • Suppress Matched • Message Condition • Create an VPO message • Set Attributes • Use Variables • Perform post-processing • Actions • Advanced Options Message Source Configuration: Message Conditions
Message Processing on the Managed Node Message(s) from sourceassigned default attributes Sequential check ofmessages against listof conditions in template Forward Unmatched To Server? Matchanyconditions? YES NO YES NO Eventdropped SuppressUnmatched SuppressMatched Match Condition Event forwarded toManagementServer Message Source Configuration: Message Conditions
Message Condition Advanced Options Can help reduce the amountof network traffic Used typically withEvent Correlation Engines Message Source Configuration: Message Conditions
Message Correlation Used for state-based browser and identical output message suppression Useful for repetitive messages in the browser Message Source Configuration: Message Conditions
Purpose Reduction of messages for persistent problems Methods Duration: Timer for inhibition Counter: Reduce events by count Reminder: Configure re-alerting after a certain delay Timers and counters can be combined Messages may be identical or similar Examples Threshold exceeded for longer than six minutes Do not process any but every fifth identical message Process security violations only after three unsuccessful logins Duplicate Message Suppression Message Source Configuration: Message Conditions
4 2 6 8 10 12 Duplicate Suppression – Example 1:Time Interval Setting Identical messages created time [min] Suppression time interval: 2 min Accept messages after: 5 min Send messages Message Source Configuration: Message Conditions
4 2 6 8 10 12 Duplicate Suppression - Example 2:Counter Usage Identical messages created time [min] Counter threshold: 3 Counter reset after: 4 min Send messages Message Source Configuration: Message Conditions
4 2 6 8 10 12 Duplicate Suppression - Example 3:Time Interval and Counter Usage Identical messages created time [min] Suppression time interval: 2 min Accept messages after: 5 min Counter threshold: 3 Counter reset after: 8 min Send messages Message Source Configuration: Message Conditions
Duplicate Suppression: Message Key Concept Message Key Definition: “my_appl_down:<$MSG_NODE_NAME>” Message Key Instantiation: “my_appl_down:my_node” Message Key Relation Definition: ACK “^my_appl_down:<$MSG_NODE_NAME>$” Message Key Relation Instantiation: ACK “^my_appl_down:my_node$” “The Message Key attribute summarizes the important characteristics of the event that triggered the message” Message Source Configuration: Message Conditions
Message Key Example Link application messages; hold maximum of one message identified by a certain message key in the browser: Fragment from an msgi-template DESCRIPTION "status message from application a1 for object o1" CONDITION ... APPLICATION "a1" OBJECT "o1" ... SET ... MSGKEY "appl_stat:<$MSG_APPL>:<$MSG_OBJECT>:<$MSG_NODE_NAME>" MSGKEYRELATION ACK "^appl_stat:<$MSG_APPL>:<$MSG_OBJECT>:<$MSG_NODE_NAME>$" DESCRIPTION "status message from application a2 for object o2" CONDITION ... APPLICATION "a2" OBJECT "o2" ... SET ... MSGKEY "appl_stat:<$MSG_APPL>:<$MSG_OBJECT>:<$MSG_NODE_NAME>" MSGKEYRELATION ACK "^appl_stat:<$MSG_APPL>:<$MSG_OBJECT>:<$MSG_NODE_NAME>$" Message Source Configuration: Message Conditions
Duplicate Messages: Agent Configuration Message Source Configuration: Message Conditions
Pattern Matching also available via opcpat Testing Message Conditions Test patterns in conditionsavailable in Condition List WindowDefine Condition Window Message Source Configuration: Message Conditions
Summary Create TemplateGroup (optional) Create Template Create suppress andmatch conditions Assign template (group)to Managed Node(s) Distribute “Templates”to Managed Node(s) Message Source Configuration: Message Conditions