Event Tuning Options

Longitude works by collecting a specified set of data for each Application you configure. After the data is collected, it is evaluated and Events are created if the data does not meet specified thresholds. For example, the Windows Application will collect CPU data, and Events will be created when the CPU usage on a device is too high.

These Events are visible in the Event Monitor, and can be used to trigger Action Rules or Correlated Events that will send notifications for the problems via email, text message, pager message, SNMP Trap, or will execute an OS command.

See Best Practices Before Turning on Notification for an outline of how to approach filtering events from the Event Monitor. The list below presents six types of Events you want to remove from the Event Monitor, and the best ways to remove them:
 
Types of Events:

1. Events based on metrics that have different baseline values across different servers. For example, CPU, Disk Free Space, or Memory.
2. Events where you are interested in some of the problems on the device, and not interested in others. For example, Events for stopped services from the Windows Application.
3. Events for an optional application component that isn't relevant to your environment. For example, Windows Print Queue or Printer collections.
4. Events for specific problems you do not intend to fix (e.g. servers with consistently high memory or CPU usage), or anticipated short term problems (e.g. high network usage on a server downloading a patch).
5. Events that are invalid during a known time period. For example, high CPU alerts during a nightly virus scan.
6. Events where you want historical reports on the data, but don't want to have the engine component analyze the data. For example, Events for Syslog or SNMPTrap data.

The methods to remove the types of events listed above are:

1. Adjust the thresholds used by the rule to generate Events
• Best used for:
  Events based on metrics that have different baseline values across different servers. For example, CPU, Disk Free Space, or Memory.
• How to implement:
  1. In Monitoring >> Manage Rules, select the Application, Task and Rule generating the alert (there is a link under Related Rule in the Event to take you there directly).
  2. Click on the ADD or MODIFY button in the Specific Values column.
  3. There will be a blank field labelled Value:, with a gray triangle to the right of the field. Click on the triangle to display a baseline for the collection with Minimum, Maximum and Average values, which can be used as guidelines in setting a specific threshold.
  4. Enter the desired value into the Value field, select the item this will apply to, and then click APPLY.
• Advantages:
  Events are more appropriate for the specific monitored devices.
• Disadvantages:
  Need to wait until enough data has been accumulated for a meaningful baseline.
  If monitoring large numbers of disparate devices, it can take time to set up individual thresholds.
2. Filter the collections in Monitoring
• Best used for:
  Events where you are interested in some of the problems on the device, and not interested in others. For example, Events for stopped services from the Windows Application.
• How to implement:
  1. In Monitoring >> Manage Applications, click on the gear icon for the application you want to filter.
  2. Click on MODIFY for the specific component you want to filter.
  3. The data currently being collected will be displayed, and you can test filters with the REFRESH STATISTICS button.
  4. Click on SAVE CHANGES to save filter settings.
• Advantages:
  Can copy the filter to multiple computers so it only needs to be created once.
  Saves data collection and archiving resources.
• Disadvantages:
  Historical data is not available for reports later.
3. Disable the collection in Monitoring
• Best used for:
  Events for an optional application component that isn't relevant to your environment. For example, Windows Print Queue or Printer collections.
• How to implement:
  1. In Monitoring >> Manage Applications, click on the gear icon for the application you want to filter.
  2. Click on MODIFY for the specific component you want to disable.
  3. Uncheck the Enabled box between the Application Properties and the Filter Parameters.
  4. Click on SAVE CHANGES .
• Advantages:
  Can copy the enabled setting to multiple computers so it only needs to be set once.
  Saves data collection and archiving resources.
• Disadvantages:
  Historical data is not available for reports later.
4. Disable the Events in the Event Monitor
• Best used for:
  Events for specific problems you do not intend to fix (e.g. servers with consistently high memory or CPU usage), or anticipated short term problems (e.g. high network usage on a server downloading a patch).
• How to implement:
  1. In the Event Monitor, select the Event that you want to remove.
  2. In the Event Details, go to the Event Shutoff section.
     Select either DISABLE to remove the event indefinitely, or enter an interval and select SUSPEND to remove the event for the selected interval.
• Advantages:
  Data is still available for reports.
  Problems you don't intend to address are not shown in the Event Monitor.
  Less overhead for the Rule Engine, Web UI, and database.
  Can remove known problems from Event Monitor until time you anticipate they should be fixed.
• Disadvantages:
  DISABLE and SUSPEND only apply to the specific measured object in the Event. For example, if you DISABLE Events for a Service Down problem on on Managed Device, it will only apply to that one service on that one device. You would need to DISABLE/SUSPEND the Events for each individual Event in the display.
5. Delete the Event with an Action rule
• Best used for:
  Events that are invalid during a known time period. For example, high CPU alerts during a nightly virus scan.
• How to implement:
  1. Go to Actions >> Manage Action Rules and select ADD ACTION.
  2. When creating the action, use a schedule that only covers the time period where the Event is not needed.
  3. Select Delete Events as the Action.
  4. Select ADD ACTION to add Action Rule.
• Advantages:
  Best way to eliminate alert notifications for known outages.
  Eliminates known alerts in Event Monitor and Event Reports.
• Disadvantages:
  Need to be careful with schedules and selections of Events in Action rule so that valid alerts aren't deleted.
6. Disable the task creating the Event
• Best used for:
  Events where you want historical reports on the data, but don't want to have the engine component analyze the data. For example, Events for Syslog or SNMPTrap data.
• How to implement:
  1. In Monitoring >> Manage Tasks, select the Application you want to disable.
  2. Select the task(s) that you want to disable.
  3. Select DISABLE TASKS.
• Advantages:
  Less overhead for rule engine and Web UI.
• Disadvantages:
  Some tasks evaluate multiple rules - disabling one task could disable rules you do want to run. Check Monitoring >> Manage Rules >> {Application} >> {Task} for the specific application and task you plan to disable to display the rules that are run by the task.