4 Replies Latest reply on Nov 13, 2017 12:43 AM by EDOARDO SPELTA

    Events being closed according to threshold duration, what do you think about it ?

    EDOARDO SPELTA
      Share This:

      Hello,

      having set server thresholds on BPPM9.6 for classic metrics like free disk space, memory utilization etc..i was investigating a case where after freeing up some disk space on a server with the PA installed, the alarm was closed 3 hours later.

      I could see this from the monitor graph, showing that free space (having been many hours near 0%) was suddenly transitioning from 0% to 25% ( well above the alarm thresholds i've set)  but the event was closed 3 hours later. In my environment i have a critical threshold set to alarm if free space is <5% (duration 0) and a major threshold set to alarm if fre disk space is below 10% for 3 hours.

       

      I've been through the docs and found something i've never realized before.

      Quoting from Threshold management - BMC ProactiveNet 9.6 - BMC Documentation

       

      "all performance data points must exceed the trigger condition for a specified duration before an event gets created. The absence of the trigger condition for the same duration will close the event."

       

      and again in Setting event thresholds - BMC ProactiveNet 9.6 - BMC Documentation where duration is defined as:

       

       

      "The duration (in minutes) of delay from when the threshold is violated to when an event is generated. The same duration is required to close an event, starting with the first data point where threshold is no longer violated."

       

       

      Basically this means that durations set on critical/major/minor thresholds will affect also the event closures by delaying them.

      You would set alarm duration to avoid getting spammed by alarms when metrics are going above/below thresholds too frequently, but why applying this to the closure  too ? What could possibly be the reason behind this ?

       

      I would like to know your opinion on this as i cannot find any reason for such a behaviour