Unicenter Automatic Duplicate Suppression EvtADS

  • View
    22

  • Download
    0

Embed Size (px)

DESCRIPTION

Unicenter Automatic Duplicate Suppression EvtADS. EvtAds r11 Field Developed Utility January 17 th 2006. Disclaimer. This is a field developed utility targeted to be included in the future release for NSM. It is not supported by the CA Support organisation. Acknowledgments. - PowerPoint PPT Presentation

Text of Unicenter Automatic Duplicate Suppression EvtADS

  • Unicenter Automatic Duplicate SuppressionEvtADSEvtAds r11Field Developed UtilityJanuary 17th 2006

    Unicenter Event Command Proxy

    2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies.

    DisclaimerThis is a field developed utility targeted to be included in the future release for NSM. It is not supported by the CA Support organisation.

    Unicenter Event Command Proxy

    2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies.

    AcknowledgmentsKevin Higgins - Cap Gemini UK plc

    Unicenter Event Command Proxy

  • Introduction

    Unicenter Event Command Proxy

    2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies.

    What is EvtAds?A simple but function rich utility to intelligently manage duplicate events to aid in auto-ticketing and eliminate opening multiple problem tickets for the same problem.Automatic Duplicate SuppressionTool for Windows Event Management

    Unicenter Event Command Proxy

    2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies.

    Problem SummaryUnicenter message processing repeats messages on the operator console unless explicitly discarded. Such duplication may prevent use of auto-ticketing or occasionally cause acute message storms, (where too many messages per second are generated).Message storm can result into denial of service if extensive instrumentation is carried out to address duplicates.

    Unicenter Event Command Proxy

    2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies.

    Automatic Duplication SuppressionEvtAds is Unicenter Event Management Anti-Duplication Suppression driven by Event Message Actions.It is specifically designed for scalability to handle large message storms without any performance degradation.In a lab environment, it has successfully processed message storm of over a million events

    Unicenter Event Command Proxy

    2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies.

    Automatic Duplication Suppression ADS is called using EXTERNAL Message action and determines if the event has been previously seen within the reset interval. It returns with an &rc indicating the number of times an event / alert has been previously seen.Analysing &RC value assists in auto-ticketing and prevents multiple tickets been raised for the same problem.Provides means of escalation based on the number of alerts received for the same problem. For example, if 15 failure events are received within reset interval period for the same problem, it would make sense to escalate the problem to emphasis the impact of the problem. Without ADS, this may result in 15 problem tickets being raised

    Unicenter Event Command Proxy

    2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies.

    Why EvtAds?Unicenter Event Management provides frequency based message rules. This is based on Counter and Interval.Frequency based event rules are driven by message records and may require complex rules to integrate with Help desk.Interval computation for Frequency event rule is based on time the first event occurred. EvtAds works on interval based on last update time this is key for effective duplicate suppression.

    Unicenter Event Command Proxy

    2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies.

    Help DeskTo provide integrity, it is important that duplicate problem tickets are not raised. Multiple problem tickets for the same problem can easily distract the main focus of resolving the problem. For this reason, duplicate Alerts should be identified and discarded (or in some cases escalated).If duplicated alerts exceed an acceptable limit, the problem should be escalated to minimise the impact. It is important to identify the number of times an alert has occurred within a clear down interval.

    Unicenter Event Command Proxy

  • Usage

    Unicenter Event Command Proxy

    2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies.

    EvtAds FunctionsCAds Checks for duplicate EventsCVersion Displays Version detailsCStatsDisplays how many events are cachedCListGenerate list of cached entries for review

    Unicenter Event Command Proxy

    2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies.

    EvtAds FunctionsCOptions

    Unicenter Event Command Proxy

    Sheet1

    Funtion NameOptionDescription

    COptions-PurgeOn Demand Purge expired entries

    -DebugOn Demand start Debugging

    -StopDebugOn Demand stop Debugging

    -ReinitReinitialise options by reading the EvtAds.dat file again. This is normally useful if Search and Replace entries have been changed

    Sheet2

    Sheet3

    2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies.

    ClearDownIntervalThis is used for computing if the cached event entry is current and not expired. It is based on Last Update time of the event.If (Last Update Time + ClearDownInterval) < Current Time, the cached event entry is expired and the duplication count of the cached event is reset to zero.This enables identification of new occurrences of problems outside the ClearDownInterval

    Unicenter Event Command Proxy

    2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies.

    EvtAds Message ActionCAds Function define msgact name=(*,10) action="EXTERNAL" attrib="DEFAULT" color="DEFAULT" condop=" " evaluate='Y' quiet='N' status="ACTIVE" sim='N' text="EvtAds.DLL CAds /T:120 /M:""&text"""Function NameClearDownIntervalMessage Text Action

    Unicenter Event Command Proxy

    2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies.

    EvtAds Message ActionCAds Function Query Optiondefine msgact name=(*,10) action="EXTERNAL" attrib="DEFAULT" color="DEFAULT" condop=" " evaluate='Y' quiet='N' status="ACTIVE" sim='N' text="EvtAds.DLL CAds /Q /T:120 /M:""&text"""Function NameClearDownIntervalMessage Text ActionQuery Option

    Unicenter Event Command Proxy

    2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies.

    Query OptionQuery option function works in the same as CAds except the cache count is not updated. The clear down rules still applies.This function is extremely useful when conditional logic is required such as Stop forward action if more than 10 forwards have failed due to destination down.

    Unicenter Event Command Proxy

    2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies.

    Sample Application of Query OptionThere is another MRA for %CAOP_E_504 with EXTERNAL action. This issues CAds Function call with /M&1,&6. This updates the cache counter to identify the number of times, the forward has failed within cleardown interval. Prior to forward action, Query option is requested to determine the number of times %CAOP_E_504 message has been generated. The query option will not update the counter. In this example if more than 5 FORWARD to node BREER01PACO have failed, forward action is suspended with appropriate messages. This would be good candidate for EVALUATE function

    Unicenter Event Command Proxy

    2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies.

    Sample Application of Query Option

    Unicenter Event Command Proxy

    2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies.

    EvtAds Message ActionSearch & Replace Override define msgact name=(*,10) action="EXTERNAL" attrib="DEFAULT" color="DEFAULT" condop=" " evaluate='Y' quiet='N' status="ACTIVE" sim='N' text="EvtAds.DLL CAds /T:600 /F:2 /M:""&(2:9)"""Function NameClearDownIntervalMessage Text Search & Replace Item

    Unicenter Event Command Proxy

    2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies.

    CVersionDisplay EvtAds Version detailsdefine msgrec msgid="EVTADS CVersion" type="MSG" msgnode="*" desc="What version of EvtAds are you running" cont='N' msgact='Y' wcsingle='?' wcmany='*' case="y" regexp