Re: De-duplication and rate-correlation (378 Views)
Reply
Honored Contributor
ramesh9
Posts: 1,030
Registered: ‎04-19-2011
Message 1 of 8 (441 Views)
Accepted Solution

De-duplication and rate-correlation

Hi All

 

Can some one shed life how does de-duplication and rate-correlation work in NNM?

 

I had setup de-duplication with count=2 and minutes=5 and if I receive 10 alarms all 10 alarms are displayed in NNM.

 

I had setup rate-correlation with count=1 and minutes=5 and if I receive 10 alarms, all 10 alarms are displayed in NNM and rate-correlation incident is created and shown in NNM console.

 

We want to show only 1 or 2 alarms in a period of 5 minutes irrespective of any number of alarms coming in to NNMi?

How can this be possible in NNMi?

 

Please help.

Please use plain text.
HP Expert
Dave Young
Posts: 482
Registered: ‎09-27-2000
Message 2 of 8 (411 Views)

Re: De-duplication and rate-correlation

Ramesh,

 

  Dedup works by cleaning up the Incident view once the incidents are displayed.  So in your test it would be expected that all 10 incidents are initially displayed in the view but then as the dedup sweeper thread runs the oldest duplicates will be removed leaving the 2 latest incidents in the view.   Over a long time window you will see the incoming incidents being constantly trimmed back to the configured 2.   The window period is used to start a new set to be trimmed, so you might expect to see 2 traps in one 5 min period and then another 2 in the next 5 min period.  Note the Dedup incident is generated when the second trap arrives  - irrespective of the count configured to be left in the browser.

 

  Rate correlation simply counts the number of duplicate traps occuring.  It does not delete or suppress any.  Setting a count of 1 does not really make sense.   Setting it to, say, 5 in 5 minutes will then cause the rate incident to be generated if and only if 5 or more duplicate traps appear within a 5 min window that starts when the first one arrived.  If only 3 are received then there will be no rate incident generated.   The incident is always generated at the end of the configured period.

 

  Finally Dedup is the solution to implement, but just be aware that you might see more incidents initially but then they should get cleared out.

 

  All the best

 

Dave Y

HP Support

The views expressed in my contributions are my own and do not necessarily reflect the views and strategy of HP

If you find this or any post resolves your issue, please be sure to mark it as an accepted solution.
Please use plain text.
Honored Contributor
ramesh9
Posts: 1,030
Registered: ‎04-19-2011
Message 3 of 8 (378 Views)

Re: De-duplication and rate-correlation

Thanks Dave for your response.

 

In our environment we have integrated nnmi with OM and we had setup de-duplication enabled for the trap configuration.

 

Once the incident arrives in NNMi it is immediately sent to OM before dedup sweeeper thread comes into action.

 

Is there any way we can prevent the duplicate incident to be sent to OM.

 

Thanks

Ramesh

Please use plain text.
HP Expert
Dave Young
Posts: 482
Registered: ‎09-27-2000
Message 4 of 8 (371 Views)

Re: De-duplication and rate-correlation

Ramesh,

 

  I don't think there is.  I would suggest to look into whether OM can detect the duplicates and suppress them. 

 

  The only other feature you have in NNMi is Dampening to try to help things out, but this will delay all the incidents, where as you would want to dampen only the duplicates.

 

  One option you could investigate and that is the use of a Causal Rule under Custom Correlation.   You could configure a new parent incident when the child incidents come in and then only forward this parent to OM and not the children.   This would work over the configured period.

 

  Otherwise I would suggest opening an Enhancement request for a solution to your  situation.

 

  All the best

 

Dave Y

 

HP Support

The views expressed in my contributions are my own and do not necessarily reflect the views and strategy of HP

If you find this or any post resolves your issue, please be sure to mark it as an accepted solution.
Please use plain text.
Honored Contributor
ramesh9
Posts: 1,030
Registered: ‎04-19-2011
Message 5 of 8 (322 Views)

Re: De-duplication and rate-correlation

Hello Dave

 

Thanks for your reply.

 

If I receive 12 alarms in 2 minutes and I want only 1 alarm to be shown in NNMi console and suppress 11 alarms, is there any way I use dampening to suppress them.

 

Is this possible using dampening?

 

Please help.

Please use plain text.
HP Expert
Dave Young
Posts: 482
Registered: ‎09-27-2000
Message 6 of 8 (306 Views)

Re: De-duplication and rate-correlation

Ramesh,

 

  Dampening won't help here since all it does is to delay when the incident appears in the incident browser.  The idea behind dampening is for the incident to be closed, either by APA or pairwise etc.

 

  What you are trying to do is a feature of "Dedup" whereby a minimum number of duplicated incidents will be displayed in the incident view while the others are removed.   However the Dedup feature displays a minimum of 2 incidents, not 1, but can suppress the other 10.  Note all the incidents are initially visible in the incident view, the duplicates are then removed on a regular interval.

 

  All the best

 

Dave Y

HP Support

The views expressed in my contributions are my own and do not necessarily reflect the views and strategy of HP

If you find this or any post resolves your issue, please be sure to mark it as an accepted solution.
Please use plain text.
Honored Contributor
ramesh9
Posts: 1,030
Registered: ‎04-19-2011
Message 7 of 8 (299 Views)

Re: De-duplication and rate-correlation

Hello Dave

 

Thanks for your reply.

 

I see if initially 12 alarms appear, then after few interval ( this ranges between 1 to 4 minutes ), 10 alarms are deleted and last two alarms are been shown along with DuplicationCorrelation Alarm.

 

I understand once you had enabled de-duplication, deduplication sweeper thread runs and does the above.

 

What is the interval of the sweeper thread, does it run once in a minute or once in 2 minutes and is it possible to configure the time interval it runs?

 

Please help.

Please use plain text.
HP Expert
Dave Young
Posts: 482
Registered: ‎09-27-2000
Message 8 of 8 (293 Views)

Re: De-duplication and rate-correlation

Ramesh,

 

   The jmx-console has a number of timers related to the Dedup processing which will affect the timings, specfically:

 

The Correlation Interval is 60 seconds

The Deletion interval is 120 seconds

The Correlate batch size is 1000 as is the Delete batch size.

 

  Therefore providing the number of incidents to be processed by Dedup is not above 1000 you should see the deletions occuring within 2 minutes, while the correlating of the children to the parent should be being done every minute.

 

  All the best

 

Dave Y

HP Support

The views expressed in my contributions are my own and do not necessarily reflect the views and strategy of HP

If you find this or any post resolves your issue, please be sure to mark it as an accepted solution.
Please use plain text.
The opinions expressed above are the personal opinions of the authors, not of HP. By using this site, you accept the Terms of Use and Rules of Participation