You can specify advanced job properties to filter temporary event conditions. If AppManager raises an event, you can configure the advanced job properties to collapse duplicate events or automatically close the event when the event condition no longer exists.
The following sections describe additional options you can use to configure data collection.
Specify criteria to filter temporary events by configuring the number of times that AppManager must detect a duplicate event condition during a specified number of job iterations before it raises an event. An event condition is considered a duplicate when AppManager detects it on the same object name with the same event message, severity, and job ID as a previous event condition.
For example, when the threshold for the number of duplicate event conditions is set to 3 and the number of job iterations is set to 5, if AppManager detects an event condition each time the job runs, it ignores the first two event conditions, raises an event for the third event condition, and starts the time interval for event collapsing.
AppManager ignores the next two event conditions it detects during the interval—only two event conditions are detected during the interval, which falls below the threshold. The event condition count resets when the interval resets, after the fifth job iteration. To raise another event, a duplicate event condition must occur three times during the next five job iterations, and if you enabled event collapsing, AppManager must generate the event within the time interval for event collapsing.
AppManager does not log ignored event conditions in the repository and does not increment the event count of the original child event. It also suppresses actions associated with ignored event conditions.
To specify the number of times AppManager must detect an event condition during a specified number of job iterations:
On the Properties window for the Knowledge Script job, click the Advanced tab.
Enter criteria to specify a threshold for raising an event:
|
For... |
Do this... |
|---|---|
|
Raise event if event condition occurs n times... |
Enter a threshold for the number of times AppManager must detect a duplicate event during the specified number of job iterations before raising an event. (The detected event conditions do not need to be consecutive.) |
|
...within M iterations |
Enter the number of job iterations to specify the interval. AppManager resets the interval after the given number of job iterations. The defaults for the number of duplicate events and job iterations are both 1, which means that AppManager does not ignore duplicate events and raises an event each time it detects an event condition. |
Click OK to start the job.
Sometimes a Knowledge Script job detects identical events. To suppress these duplicates and their specified actions, you can set event collapsing options. You can set these options globally, for all jobs, or for individual jobs. This section discusses how to set event collapsing options for each job you run.
NOTE:For more information about duplicate events and global event collapsing options, see Section 6.8, What Are Duplicate Events?.
To change the event collapsing options for a job:
On the Properties window for the Knowledge Script job, click the Advanced tab.
Filter temporary event conditions by specifying the number of event conditions AppManager must detect during a specified number of job iterations. If AppManager detects an event condition the specified number of times during the interval, it raises an event. For example, to configure a job to raise an event if AppManager detects the event condition twice during an interval of five job iterations, set Raise an event if event condition occurs to 2 times within 5 job iterations.
For more information, see Section 5.8.1, Filtering Temporary Event Conditions.
Select Collapse duplicate events into a single event.
AppManager logs duplicate events in the repository; however, it suppresses actions associated with collapsed duplicate events, whether the actions are initiated on the managed computer, management server, or proxy computer.
Set the Time interval for event collapsing. The default time interval is 20 minutes.
AppManager collapses any duplicate events it created within the time interval into the original child event. The time interval can be measured from when AppManager detects the first event condition or when it detected the most recent event condition.
Click OK to start the job.
NOTE:Event collapsing options set on the Advanced tab in the Properties window affect only the job you are about to run. To set global default event collapsing options for all Knowledge Scripts, use the Operator Console to set the QDB preferences. For more information, see the Operator Console User Guide for AppManager, available on the AppManager Documentation page.
When you are monitoring a Windows resource that tends to raise events frequently, you can reduce the amount of time you spend managing these events by configuring the job to automatically close an event when the event condition no longer exists.
The first time AppManager detects an event condition, it creates a parent event and a child event; it does not raise additional events as long as the event condition persists, and it does not increment the event count for the child event. When the event condition no longer exists, AppManager creates a new event to indicate the change in the event condition and optionally, closes the original event. You can set this option globally for all jobs or for a particular job. This section discusses how to automatically close events for each job you run.
NOTE:For more information about automatically closing events and global options, see Section 6.9, How Events Are Automatically Closed When the Event Condition No Longer Exists.
To automatically close events for each job you run:
In the Properties window for the Windows-based job, click the Advanced tab.
Select Generate a new event when original event condition no longer exists. With this option, AppManager raises an event when the event condition that initiated the original event no longer exists. Note that this option is not available when configuring a job to run on a UNIX or Linux computer.
With this option selected, you can specify the event severity when AppManager raises an event in response to the change in the event condition. By default, the event severity is set to 20.
To close the original event when the event condition no longer exists, select Automatically close original event.
Click OK to start the job.
There are several data collection options you can use to optimize how a Knowledge Script job collects data and specify whether data is flagged for upload to the NetIQ Corporation Analysis Center.
You can set data collection options for all jobs or a particular job. This section discusses how to set data collection options for each job you run. For information about configuring global data collection options, see the Operator Console Help.
To change data collection options for a job:
In the Properties window for the job, click the Advanced tab.
Select an option to specify whether to collect data details:
|
Select... |
To... |
|---|---|
|
Collect data details with data point |
Collect details for each data point (such as server name and collection time). This option only applies to data collection for AppManager graphs and charts. AppManager displays these details when you want to view the details of a data point in a graph or chart. This option is selected by default. |
|
Do not archive data detail |
Select this option to only collect the value of the monitored resource; AppManager does not collect the detailed information, such as server name and collection time. This option only applies to data collection for AppManager reports that display detail data, such as ReportAM_DetailData. This option is selected by default. |
To control how frequently AppManager collects a data point, update Collect data every n iterations to specify the number of times that a job must run to collect data.
For example, if a Knowledge Script job is set to run at regular intervals of 10 minutes and you set this value to 3 iterations, AppManager creates a data point every third time the job runs, or every 30 minutes. The default is 1 iteration, which means AppManager creates a data point every time the job runs.
If you configured the job to create a data point once for a specified number of iterations, select Calculate average to create that data point as an average value of all data points measured for all iterations. For example, if you configure the repository to collect a data point every 3rd time a job runs, and the data point for the first iteration is 2, the data point for the second iteration is 5, and the data point for the third iteration is 10, AppManager creates the data point with a value of 5.6666 on the third iteration.
To begin collecting data when AppManager raises an event, select Start collecting data when an event is generated. For example, if a Knowledge Script job is set to raise an event when CPU usage exceeds 70%, then the job will also start collecting data at that point.
When you finish, click OK.