## About How Events Are Generated

Most generated diagnostic and monitoring events are based on health transitions. When, for example, the state of a device goes from online to offline, a health transition occurs. It is the transition that generates an event, not the offline state.

Transitions cannot be used in the monitoring of log files, so log events can be very repetitive. You can minimize this problem by attaching thresholds to entries in log files.

Thresholds ensure that a minimum number (up to eight) of log file entries occurs within a certain time period before an event is generated. The diagnostic and monitoring software also includes a database that keeps track of the number of events generated about the same subject in the same 8-hour timeframe. You can use this database to stop the generation of repetitive events. For example, if the port of a switch were toggling between offline and online every few minutes, the event maximums database would ensure that this toggling was reported only once every 8 hours, instead of every 5 minutes.

Events are usually generated as follows:

- The first time a device is monitored, a discovery event is generated. It is not actionable, but it is used to set a monitoring baseline, primarily for the Sun Network Storage Command Center (NSCC). This event describes, in detail, the components of the storage device. Every week after discovery, an audit event is generated with the same content as the discovery event.
- A log event can be configured to generate an event alarm when information of a particular type is found in host or storage log files. This information is usually associated with storage devices and sent to all configured notification providers.
- Events are generated when the software detects a change in the content of the instrumentation report, probes the device, and compares the current report with the last report (which is usually only minutes old). Most of the events that are generated fall into the StateChangeEvent and TopologyEvent categories.
- When possible, an agent combines events to generate aggregated events.

Note -

Aggregated events, as well as events that require action by service personnel (known as actionable events), are also referred to as alarms.

### Related Topics

- Using the Event Advisor
- Setting Email and Event Maximums