There are various types of event storm that can negatively affect the performance of your Netcool® environment and potentially lead to application downtime.
Typically, either a specific device will send the same event repeatedly, many times a second, or a group of devices will start to send a significantly higher number of events than your are expecting. Whatever the exact scenario in your environment, an event storm can be simply defined as the sudden receipt of a higher than normal number of events that may negatively impact upon service performance. The Abilisoft MTM solution will detect such an event storm, and notify you when the storm starts.
An event storm is detected either by the number of events in the ObjectServer from a specific Netcool Probe increasing and breaching the specified threshold, or by the detection of a sudden increase in the Rate Of Change measurement of events from a specific Netcool Probe. The image below shows the number of events received from a specific Probe increasing an breaking the upper threshold.
A pre-determined corrective action can take place once the event storm is detected by Abilisoft MTM, to help reduce the negative performance impact on the rest of the Netcool® environment. An example of this would be to dynamically modify the affected Probe's configuration so that it discards non-critical events. The type of corrective action to take is dependant on your environment, and is customisable to meet your requirement.