## Event Life-Cycle

Most Storage Automated Diagnostic Environment events are based on health transitions. For example, when the state of a device goes from online to offline, a health transition occurs. It is the transition from online to offline that generates an event, not the actual value offline. If the state alone was used to generate events, the same events would be generated all the time. Transitions cannot be used when monitoring logfiles, so log events can be repetitive. To minimize this problem, attach thresholds to entries in the logfiles.

Thresholds ensure that a minimum number of logfile entries within a certain time period occur before an event is generated. The Storage Automated Diagnostic Environment also includes an event maximums database that keeps track of the number of events generated about the same subject in the same eight-hour timeframe. This database stops the generation of repetitive events when there is no other way to do it. For example, if the port of a switch was toggling between offline and online every few minutes, the event maximums database ensures that this toggling is reported only once every eight hours instead of every five minutes.

Events are usually generated using the following guidelines:

1. The first time a device is monitored, a discovery event is generated. It is not actionable and it is used to set a monitoring baseline, primarily for NSCC. This event describes, in detail, the components of the storage device. Every week after discovery, an audit event is generated. It has the same content as the discovery event.
2. A log event can be generated when interesting information is found in host or storage logfiles. This information is usually associated with storage devices and sent to all users. These events can be made actionable based on thresholds, and then sent using the Net Connect provider, if enabled.
3. Events are generated when the software detects a change in the content of the instrumentation report, probes the device, and compares the report to the last instrumentation report, which is usually only minutes old. StateChangeEvent and TopologyEvent categories represent most of the events that are generated.
4. When possible, the Storage Automated Diagnostic Environment master agent combines events to generate aggregated events.

Note -

Aggregated events and events that require action by service personnel (known as actionable events) are also referred to as alarms.

### Related Topics

- Monitoring Strategy
- Monitoring Cycle