When you run a Knowledge Script that generates events, each time the Knowledge Script runs and detects that a threshold has been crossed or a process is down it generates a parent and child event and detailed information about the event and stores the information in the AppManager repository. Once the information is stored in the repository, you can:
View event alerts in the Enterprise Layout view of the Navigation pane in the Control Center console.
View parent and child events in Events views in the Control Center console.
View detailed information for events in the Event Properties dialog box.
For more information about viewing and working with events, see the Control Center User Guide for AppManager, available on the AppManager Documentation page.
When you run a Knowledge Script and enable events, AppManager creates both a parent and child event for the first occurrence of the event condition. For subsequent occurrences, AppManager creates additional child events under the parent event and updates an event counter indicating the number of child events. AppManager can detect unique and duplicate child events. An event is considered a duplicate when it occurs with the same object name, event message, severity, and job ID as a previous event within a certain period of time.
Although duplicate events are typically valid, receiving multiple events caused by the same condition is not useful. For example, if you are monitoring a disk every 10 seconds and at 18:00 the disk crosses the threshold you specify, AppManager can generate a new event every 10 seconds. In addition, if you associated an e-mail action with this job, AppManager can send an e-mail message every 10 seconds containing the same information.
By default, AppManager reduces the number of individual events (and actions) you receive by collapsing duplicate events into a single event and incrementing the event counter. In this way, AppManager reduces the “noise” from a recurring or persistent issue. You are still informed that the event occurred multiple times, but you are not overwhelmed with event messages or redundant e-mail messages.
AppManager uses a time limit for collapsing these duplicate events. For example, if an event occurs at 18:00, by default, 20 minutes must elapse in which the condition does not recur before a new event is generated. If an event occurs every 10 seconds, a new event is never displayed; AppManager simply increments the event count. If the event occurs at 18:00 and the time frame is 18:20, when the event occurs again at 18:00:10 the time frame is adjusted to 18:20:10. When the event occurs again at 18:01 the time frame is adjusted to 18:21, and so on.
For an individual job, you can adjust the time interval by selecting Initial occurrence in the Advanced tab in the Knowledge Script Properties dialog box. Or you can change the default behavior by setting the Advanced Properties repository preference. Use this preference if your monitoring is critical and you want to receive events and actions on a regular basis until the problem has been resolved. For example, if the event occurs at 18:00 and then again at 18:01, you receive one event showing an event count of 2. Then, if the event occurs again at 18:20, you receive a new event (and action). By default, you would have waited until 18:21 for the new event.
NOTE:If you acknowledge or close an event and the condition recurs, a new event is generated. Event collapsing only occurs while the original event is open.