[Search for users] [Overall Top Noters] [List of all Conferences] [Download this site]

Conference azur::mcc

Title:	DECmcc user notes file. Does not replace IPMT.
Notice:	Use IPMT for problems. Newsletter location in note 6187
Moderator:	TAEC::BEROUD

Created:	Mon Aug 21 1989
Last Modified:	Wed Jun 04 1997
Last Successful Update:	Fri Jun 06 1997
Number of topics:	6497
Total number of notes:	27359

5232.0. "EVENT avalanches - How can these be handled ?" by KETJE::PACCO (Gallia divisa est in partes tres) Tue Jun 22 1993 05:42

    	When encountering an "avalanche" of events, the management station
    becomes "unusable" just at the time where the need is absolutely
    required.
    
    Several times already, it happens that the network sends a lot of
    events to the management station.  At that time the CPU usage increases
    dramatically and there is few or NO idle CPU any more on the system
    (ULTRIX).  I expect this will happen more and more as the
    network size is increasing.
    
    AS LONG AS THIS PERSITS I have no control any more on the notification
    window.  The notifications are coming at an high rate, which
    means you cannot READ the notifications.  You also cannot freeze the
    window to have a snapshot of what happens.  The window is continuously
    moving and modifying and you can better take a coffee than try to use
    DECmcc during that time. That time can also last forever if you cannot
    pinpoint the location from where the events are coming ...
    
    
    ANOTHER phenomena I encountered during such an "avalanche" is that the
    last line (lines) of the notification window is being updated
    continuously, and all lines with "older" notifications are not being
    shifted upwards.  Although the lines are not moving upwards, the
    window is continuously going up and down and up and down .. as a
    whole, except for the last line of which I see the event notification
    ID inceasing steadily.
    
    
    	The "avalanche" situations are "uncontrollable" and therefore it
    would be impossible to have a management station powerfull enough to
    handle all this smoothly I think.  On the other hand the "avalanche"
    situations will always exist on ever increasing networks which also
    becomes more and more powerful.
    
    Is there anything you can do to get (partial) information during this
    "avalanche" situations?, To freeze the notification window for a while?
    
    
    	Dominique.

T.R	Title	User	Personal Name	Date	Lines
5232.1	What kind of horse power?	TOOK::MINTZ	Erik Mintz	`Tue Jun 22 1993 08:08`	4
	Out of curiosity, what size CPU are you using on this network? -- Erik
5232.2	Filter out some of those events	TOOK::PURRETTA	enigma	`Tue Jun 22 1993 11:51`	15
	It sounds to me like you have no selective filtering of events on the ENTITY side. So EVERY event generated gets sent to mcc, goes through all the required processing by the EVL, Access Modules, FM's and PM's and finally displayed. Even if you ultimately aren't interested in it. Multiply this by 'n' entities which are furiously generating events and you've placed a heck of a strain on your management station _and_ you've forced yourself to wade through lots of uninteresting events. Try filtering at the entity side. In DNA5 terms, which I'm familiar with, you would read about how to set the NODE EVENT DISPATCHER OUTBOUND STREAM Specific Filter and Global Filter.
5232.3	PAUSE the Notification Window	TOOK::R_SPENCE	Nets don't fail me now...	`Tue Jun 22 1993 14:16`	4
	Also, try clicking on the "PAUSE" button which will freeze the notification window and let you look at things. s/rob
5232.4	PAUSE is one good thing !	KETJE::PACCO	Gallia divisa est in partes tres	`Wed Jun 23 1993 09:56`	20
	Thanks for the idea of the PAUSE button ! For the management I use a DECsystem 5000/240 with 64MB at this time... (6 stations are planned). The network size will be a few 100ths systems, and a few 100ths of routers. The customers Idea is to have almost all events sent to (at least) 2 management stations but have the filtering done at the management station. Only the events which are too frequent, or of no interest will be filtered at the source (router, ULTRIX) level. I have not made an analysis of all possible events, bu I can imagine that we are interested to see some kind of events, which potentially couls provoke an avalanche of events. Not sending these events over the network would mean you even don't see that something is wrong. Regards, Dominique.
5232.5	SmartAgent concept	SKIBUM::GASSMAN		`Tue Jun 29 1993 14:08`	9
	Synoptics has an interesting concept that make make this problem less in the future. Called the "SuperAgent (TM)", it's a UNIX process that deals with topology, asset, or event correlation details, then deals with various managers thru a new SNMP MIB. This is distributed management in a form that will put the smarts closer to the action, and allow ANY manager to deal with the data. For now, their product is focused on Synoptics HUBs and Cisco routers. bill