Need to reduce number of incoming alerts, I have tried Rate correlation, deduplication this will increase the alert by sending extra alert saying deduplicate correlation or rate correlation.
My requirement is if I get a 1000 alert from a particular node with the one source that need to be suppressed into 1 alert for link flapping many number of alerts come, can I do the suppression and send only one alert as bulk alert or duplicate alert.
Excellent question. I would like to recommend you do deduplication with a dampening, in order to reduce the quantity of traps. Basically the dampening wil return the traps per periods, if before of this period the trap is closed, it's deleted. Then if this traps never comes to NNMi, this trap comes to a deduplication and will delete more traps.
Please let me know if this helps.
The views expressed in my contributions are my own and do not necessarily reflect the views and strategy of HP. If you find this or any post resolves your issue, please be sure to mark it as an accepted solution,If you are satisfied with anyone’s response please remember to give them a KUDOS and show your appreciation.
This whitepaper describes the NNMi event pipeline and Incident configuration. It includes the following Incident configuration options: • Deduplication • Rate Correlation • Incident Suppression • Enrichment • Actions
Hope this help!
Do let us know should you need further clarification!
Best Regards, Dong HP Support IF this or any post resolves your issue, Plz be sure to mark it as an accepted solution. To show your appreciation, click KUDOS !!!