HP Network Direr Software Products manual Event Correlation, Recurring Event Handling

324CHAPTER 8: THE EVENT LOG

Events may also be manually resolved. See “Manually Resolving Events” on page 334 for more information.

Smart Event Analysis The Events System provides a set of features that work together to filter and interpret the generated events and provide you with the best possible picture of the state of your network. These features are event correlation, recurring event handling, event suppression and SNMP trap filtering, and are known collectively as Smart Event Analysis. See “Controlling Smart Event Analysis”on page 352 for more information.

Event Correlation

The event correlation feature analyzes the events that are being generated, determines sets of events that have been caused by the same issue, and replaces each set with a single event that more clearly describes the issue.

For example, if there is a set of Device not responding and Link is unavailable events generated for a group of connected devices within a short period of time, then the event correlator will analyze these events, determine that they are caused by a loss of connectivity to that section of the network and replace the set of events with a single Section of network down event.

Recurring Event Handling

Events may be generated repeatedly if a monitor regularly crosses a threshold or if the same SNMP trap type is received repeatedly from a device. If all of these events were logged separately in the event system then they would quickly outnumber other events, making it difficult to determine the real problems in your network.

The recurring event handler helps avoid this situation by determining when the same event is being generated repeatedly for a particular device or link, and then replacing all occurrences of the event with a single event that has the recurring severity. The recurring event handler then continues to scan for further occurrences of this event, prevents them from being logged and updates the already logged recurring severity event with the total number of times that the event has been generated.

Recurring events take longer to resolve than non-recurring events as 3Com Network Director waits to ensure that no further events of the same type and source are being generated.