Is there any option to publish one alarm for each duplicate event?

Document ID : KB000044551
Last Modified Date : 14/02/2018
Show Technical Document Details

Introduction: 

 ntevl probe will publish only one alarm even if events are duplicated.

 

 This is an example procedure that ntevl probe detected two duplicate events, but published only one alarm.

 

From ntevel.log (loglevel = 3)

Sep  6 17:18:32:816 [2940] ntevl: EvtFormatMessage failed: message or message id not found

Sep  6 17:18:32:816 [2940] ntevl: Error getting Task category for event DETAILS: Publisher: EventCreate EventID: 999

Sep  6 17:18:32:822 [2940] ntevl: Level is :Error

Sep  6 17:18:32:822 [2940] ntevl: RecordHandler - log=1, count=0, number=13682

Sep  6 17:18:32:822 [2940] ntevl: EventHandler (allevents - 13682)

Sep  6 17:18:32:822 [2940] ntevl: AddToAlarmList - Number of entries in list = 78

Sep  6 17:18:32:827 [2940] ntevl: AddToAlarmList - Add event to list - ntevl probe detected an event, then added it to list for publishing alarm. 

Sep  6 17:18:32:828 [2940] ntevl: Item List Count :0

Sep  6 17:18:32:828 [2940] ntevl: 

 Log: Application 

 Sev: 1 

 SRC : EventCreate 

 Cat: None 

 EId: 999 

 USR: TESTSVR\Administrator 

 COM: TESTSVR 

 DES: TEST ERROR MESSAGE 

 NAM: allevents

Sep  6 17:18:32:828 [2940] ntevl: variables list is empty.

Sep  6 17:18:32:829 [2940] ntevl: (EventHandler) - Alarm Message is EventCreate(999 - None): TEST ERROR MESSAGE

Sep  6 17:18:32:833 [2940] ntevl: RREPLY: status=OK(0) <-10.130.236.35/48001  h=37 d=28

Sep  6 17:18:32:833 [2940] ntevl: SREQUEST: _close ->10.130.236.35/48001

Sep  6 17:18:32:833 [2940] ntevl: Variable not found.Event found, trap sent: allevents: Application: 13682

...

Sep  6 17:18:32:839 [2940] ntevl: EvtFormatMessage failed: message or message id not found

Sep  6 17:18:32:839 [2940] ntevl: Error getting Task category for event DETAILS: Publisher: EventCreate EventID: 999

Sep  6 17:18:32:844 [2940] ntevl: Level is :Error

Sep  6 17:18:32:845 [2940] ntevl: RecordHandler - log=1, count=0, number=13683

Sep  6 17:18:32:845 [2940] ntevl: EventHandler (allevents - 13683)

Sep  6 17:18:32:845 [2940] ntevl: AddToAlarmList - Number of entries in list = 1

Sep  6 17:18:32:845 [2940] ntevl: AddToAlarmList - Duplicate event - ntevl probe detected duplicate event, then ignore it. It means no more alarm would be published for the duplicate event.

Sep  6 17:18:32:845 [2940] ntevl: Variable not found.Event found, trap sent: allevents: Application: 13683

 

Question: 

 Is there any option to publish one alarm for each duplicate event?

 

Answer: 

 Current ntevl probe does not have such option.