Conference csc32::consolemanager

1534.0. "Event intervals versus filter intervals...... on digital unix (3.2d)" by KERNEL::COFFEYJ (La Feline Flooz - a unix cat) Wed May 21 1997 06:20

Hi, 

I wonder if anyone with more experience of configuring rather 
than supporting and recognising bugs in console manager can 
help me and my customer here..... 



Query: They have some filters set up and can set parameters in the filter
groups. They however have some confusion between the purpose of filter
intervals and event intervals. He's tried reading the man pages but still isn't
clear.

Their situation is that they're generating pager commands from the filters
(a script uses x25 to the pager each time they have a serious event)
however certain events repeat themselves quite a bit (such as "filesystemfull")
and the system is trying to page out each time the event happens. This of
course is rather overloading the pager system and they'd like the action to be
filtered to only happen once for each *grouping* of events rather than for
every occurance of the event.

He thinks it sounds like filter intervals are what he needs to use, either that
or event intervals but he's not sure.  Can we confirm which he should be using
for this??



Thanks in advance if you can tell me which to tell the customer to use :-) 

Jo. 

    Jo,
      The filter interval sets a timer for evaluation of the entire filter.
    As ENS evaluates each filter it checks to see if a timer is running for
    that filter. If there is, then ENS does no further evaluation of the
    filter and moves on to the next filter. If the timer interval is 0
    there cannot be a timer so the filter will be evaluated.
    
    The event interval sets a timer for each event thats listed in the
    filter. Let's say EVENT-A is received from 10 nodes all within a 5
    second interval. Let's say the filter we are evaluating has a 10 second
    event interval. The event will be dispatched only once because all
    iterations of EVENT-A occurred within 10 seconds *after the first one*.
    If another 5 seconds elapses, the timer expires and the next occurence
    of EVENT-A will be dispatched.
    
    Now you said "groupings" of events so I could take this to mean:
    
    1. The events specified in the filter is a "group". If this is true
       then you'd want to use FILTER interval.
    
    2. The same event occurring within a short time. if this is the case
       then you want to use Event interval.
    
    Make sense?
    
    Regs,
       Dan