6.8 What Are Duplicate Events?

The first event a job generates creates both a parent entry and a child event entry. AppManager lists subsequent events from the same job as additional child event entries under the parent event, and an event count tracks the number of child events. (The count for the parent entry is the sum of the count for each child entry.)

A Knowledge Script job might detect unique events (for example, events with a different severity or message) or identical events. AppManager considers an event identical, or a duplicate, when a new open child event with the same object name, event message, severity, and job ID as a previous event occurs. As with unique events, AppManager logs duplicate events in the repository and, if event collapsing is not enabled, lists them as additional child event entries under the parent event. If you specified actions, AppManager initiates them for each duplicate event.

Although duplicate events are typically valid, it usually is not useful to receive multiple alerts caused by the same problem or condition. In addition, you probably do not want these identical events to initiate duplicate actions, such as repeated e-mail notification or messenger dialog boxes.

To filter temporary event conditions (not just collapse them), you can specify the number of duplicate event conditions that AppManager must detect during a specified number of job iterations before it raises an event. This option is useful in reducing the number of trivial events reported to the management server. AppManager does not log filtered event conditions in the repository and does not increment the event count of the original child event. AppManager also suppresses actions associated with ignored events.

After AppManager raises an event, it can collapse subsequent duplicate events into a single event. Instead of creating new child event entries, AppManager collapses duplicate events into the original child event and increases the child event count. AppManager logs the duplicate events in the repository; however, it suppresses actions associated with collapsed duplicate events, whether it initiates the actions on the managed computer or management server.

AppManager collapses duplicate events within a specified time interval (the default is 20 minutes). You can configure the event collapsing time interval to begin:

After AppManager closes the original child event, or after the event collapsing time interval expires, it creates a new child event and, if you specified an action on the management server, initiates the action when it detects the event condition.

You can configure event collapsing options globally (so that they apply to all Windows‑based Knowledge Script jobs) and for individual Windows-based jobs. For more information about where to set the options for all jobs or an individual job, see the Operator Console User Guide for AppManager, available on the AppManager Documentation page.

The following example explains how event collapsing works when a job detects a problem and raises an event and continues to detect the same condition every 5 minutes for a total of 12 identical events.

Without event collapsing enabled, AppManager lists a parent entry and 12 child entries. The count for each child entry is 1; the count for the parent entry is 12. AppManager logs all 12 events in the repository and initiates 12 instances of the specified action.

With event collapsing enabled but without ignoring events (using the default values of 20 minutes for Time interval for event collapsing and the event condition must occur 1 time during 1 iteration), the first event creates a parent entry and one child entry, and begins the 20‑minute time interval. Because the duplicate events take place at five‑minute intervals, the 20-minute event collapsing interval never expires (it restarts after each duplicate event). And, because the number of events and the number of job iterations is set to 1, AppManager does not ignore duplicate events; instead, it collapses each into the initial child entry.

AppManager lists a parent entry and one child entry; the count for each is 12. AppManager logs all 12 events in the repository but only initiates one instance of the specified action.

With event collapsing enabled and with events ignored (using 20 minutes for Time interval for event collapsing and the event condition must occur 5 times within 5 iterations), AppManager ignores the first four events. The fifth event generates a parent entry and one child entry, and begins the 20-minute time interval. The next four events (six through nine) take place during the 20-minute interval and AppManager ignores them. The next event (ten) generates a new child event and restarts the time interval and the job iteration interval. AppManager ignores the eleventh and twelfth events.

AppManager lists a parent entry and two child entries. The count for each child entry is 1; the count for the parent entry is 2. AppManager only logs the two listed child events in the repository and initiates their actions. It ignores the other events and actions.