Agents collect and process data using rulesets in order to pass alarms to the Alarm Server. To conserve system resources, agents use a common process called an Agent Container. The Agent Container is a simple container that works behind the scenes to house all the agents in a single process.
The following outlines the basic process of using the Event Manager to collect and deliver alarm information:
The agents for the Event Manager are configured to collect data (ASCII or binary data) from a specific source, such as a server port, a client port, a device type (such as a modem or a router), a SNMP trap, or a process.
The agents apply rulesets to the source data and distills the information to create events and alarms.
During agent creation, the Configuration Server assigns rulesets to agents. This information includes the sources to communicate with and the rulesets to run.
The agents then deliver the derived events and alarms to the Alarm server, which then manages the state.
For example, a device sends an alarm at regular intervals until the alarm is fixed. A ruleset determines how the data is converted into alarms, and the agent forwards them to the alarm server. The alarm server escalates alarm severity if an operator or a technician does not acknowledge or fix the alarm within a certain amount of time.
There is no limit on the number of agents or Agent Containers that can send alarms to the Alarm server.
The maximum number of alarms an Agent Container can hold in its outbound queue is set to 4,000. After reaching this limit, it discards the oldest alarms. For example, if the Alarm server is unavailable and cannot forward alarms, it discards the oldest alarms. To customize this setting, see Section 3.4, Setting Custom Properties for Alarm Server Connectivity and Alarm Server Functions.