Changes

An event storm is ''a large number of informational, warning and exception events of the same type from one or more nodes over a relatively short period of time''. The events will appear in your Veloopti organisation either as individual events or as duplicates of events. The factors with detecting an event storm are the number of events that match the rule, called the ''Breach count'', and the time window that they are detected within, called the ''Breach duration''.

The main factors with detecting an event storm are the number Storm events have increasing levels of events severity that match the rule and come into effect by having an increasing breach count relative to the time window (breach duration) that they are detected withinreceived in.

Storm == Starting and ending the event storm ===== How event storms are raised ===For the events that match the path of the event storm rule, each minute the following is performed. It does not matter whether they are new events or [[Event#Previous events and duplicates|duplicate]] events.# If the number of events that that are received over the exception breach duration are added together and exceed the exception breach count then an event with the severity level of exception is raised.# If the number of events that that are received over the warning breach duration are added together and exceed the warning breach count then an event with the severity level of warning is raised.# If the number of events can increase that that are received over the information breach duration are added together and decrease in exceed the exception breach count then an event with the severitylevel of information is raised.

== Where == Changing severity while the event storms come from storm is still active ====Each minute Once a storm rule is breached the event storm will continue to be monitored in the number same manner as above to see whether there is an increase in severity. If there is an increase in severity of events that are received that match the path of event the event is increased in severity and the storm rule relivent notifications are added togethersent out. When adding the Storm events together it does do not matter whether they are new events or [[Event#Previous events and duplicates|duplicate]]decrease in severity.

=== How event storms are detected ended ===The When the current event count for the path no longer exceed any of the informational, warning or exception breach duration windows thresholds over the breach durations the reset conditions can be evaluated. The reset breach count and durations are compared with then checked in the same manner as the total number of actual events that have been received during each specified initial breach duration time windowcondition. If a breach is detected none of the reset conditions are met then the storm event can be closed. If one with of the reset conditions are still being met then the highest severity either creates a new storm event or increments the duplicate count of remains open with the pre-existing oneseverity.

==Notifications == Changing Notifications will occur once with any new storm event or once with an increase of severity while the level. Therefore a storm event that is still active ====Once opened with a severity of information will initially send a storm rule notification when it is breached it first opened. It will continue also send a notification if the severity is increased to be monitored for warning and again if the current number severity is increased to exception. Whereas a storm event that is opened with a severity level of events during its breach duration window warning would not send a notification if the event decreased severity to determine whether information. However it would send a notification if the event severity of the increased to exception. A storm event needs that is opened as a exception would not notify if it reduces in severity to changeeither warning or normal.

=== Ending the Event storm =properties ==When A storm rule is opened by clicking on its name on the current event count for the path no longer exceed any of the informational, warning or exception breach duration thresholds the reset conditions are then compared to the current event count to determine if the event can be closed[https://ap1. If no reset condition is met then the storm event remains open with the pre-existing severityveloopti. === Notifications ===Notifications will occur once with any new storm event or increase of severity level of a current storm eventcom. Therefore a au/storm event that is opened with a severity of information will initially send a notification when it -rules Storm rules] web page which is first opened. It will also send a notification if the severity is increased to warning and again if the severity is increased to exception. found under Whereas a storm event that is opened with a severity level of warning would not send a notification if the event decreased severity to information however it would send a notification if Events on the event severity increased to exceptionmain menu. A storm event that is opened as a exception would These pages are protected using permissions so not notify if it reduces in severity everyone may be able to either warning or normalsee them.

== Event storm properties ==A storm When creating or modifying a rule is opened that does not abide by clicking on its name on the [https://ap1.veloopti.com.au/logic of the storm-rules Storm rules] web page which engine then the text is found under the Events main menu itemmarked in red indicating that it needs to be changed. These pages The rule is that storm events with an increasing level of severity are protected using permissions meaning not everyone is able required to have an increasing breach count relative to see themthe time window (breach duration) that they are received in. So for the same time period, the most number of events should be received for an exception, with a lesser amount for a warning and the least for information.

When a change # If the number of events that that are received over the exception breach duration are added together and exceed the exception breach count then an event with the severity level of exception is made raised.# If the number of events that does not abide by that are received over the logic warning breach duration are added together and exceed the warning breach count then an event with the severity level of warning is raised.# If the storm rules engine number of events that that are received over the information breach duration are added together and exceed the exception breach count then an event with the text severity level of information is marked in red indicating that it needs to be changedraised.

:'''Name''': The name of the storm rule. This is used in the short description of the event that will appear appears in the event view and also in the email subject line.

:'''Event [[Path|path]]''': This is the path that is used when counting the events each minutedetecting an event storm.

:'''Help Text''': This text appears in the event that is created displayed in the event view and also in the body of the any notification email.

The parameters in the information setting define the number of events or and duplicates and the time period over which they should be received in order to create or reduce a higher level severity an storm event with the status of information. It also contains one of the parameters for closing an open event. Information Storm events have the lowest level of severity of all of the storm events. Informational severity storm events should be used to inform your users that an event storm has occurred but there is no impact yet to your monitored IT infrastructure.

:'''Breach Count''': This is the minimum number of events or and duplicates per '''''breach duration''''' that must be exceeded in order to create a storm event with the status of information. As long as a storm event is open and this condition is met, the storm rule will continue to be in breach with an information severity levelof infomration. When this condition is not being met then the reset conditions are checked to see whether the open event can be closed.

:'''Breach Duration''': This is the time period over which the minimum number of '''''breach count''''' events or and duplicates in order to trigger a storm event with the status of information.

:'''Reset Count''': If there is no breach condition being met then this is the number that the events or duplicates event and duplicate count must be equal to or less than during the '''''reset duration''''' before the event is may be closed. This As this is the smallest reset count condition if it is met then this will close an signify that the eventcan be closed. The event that is being closed can have a severity of either information, warning or exception.

:'''Reset Duration''': This is the time period over which the minimum number of '''''reset count''''' events must appear in order to close the storm event.

:'''Notify Users''': This is a list of users who will be notified when a storm event with the severity of information breaches the '''''breach count''''' for the first time. If the storm event is first created with a warning or critical severity level then the users in those settings will be notified.

:'''Notify User Groups''': This is a list of user groups that will be notified when a storm event with the severity of information breaches the '''''breach count''''' for the first time. If the storm event is first created with a warning or critical severity event the user groups in those settings will be notified.

The parameters in the warning settings define the number of events or and duplicates and the time period over which they should be received in order to create a storm event with the severity of warning. It also contains the some details to reduce or increase an existing open storm event to a higher or lower level severity level. If the breach conditions are no longer being met for a storm event with the severity of exception then the warning breach conditions are next checked to see whether the event can be reduced to warning. Additionally if a storm event with the severity of normal now meets the warning breach conditions the then its severity level is increased to warning. Storm events with a severity of warning come between the information and exception severity events. They come into effect by having a larger breach count relative to the time window (breach duration) of informational severity events but are not as large in number as exception level severity events. Warning level storm events should be used to inform your users that an event storm has occurred that is impacting your IT infrastructure in a negative way and something should be done to resolve it before it increases in severity to exception. It also contains one of the three conditions for closing an open storm event.

:'''Breach Count''': This is the minimum number of events or and duplicates per '''''breach duration''''' that must be exceeded in order to create or change a storm event with the status of warning. While the storm event with a severity of warning is open, as long as this condition is met the storm rule will continue to be in breach. When this condition is not being met then the reset values are checked.

:'''Breach Duration''': This is the time period over which the minimum number of '''''breach count''''' events or and duplicates in order to trigger a storm event with the status of warning.

:'''Reset Count''': If there is no breach condition being met then this is the number that the events or and duplicates must be equal to or less than during the '''''reset duration''''' before the event can be reduced to warning.

The parameters in the exception settings define the number of events or and duplicates and the time period over which they should be received in order to create a storm event with the severity of exception. It also contains the details to increase an existing open storm event to a severity level of exception. If the breach conditions are no longer being met for a storm event with the severity of exception then the warning first followed by normal breach conditions are then checked to see the event should be changed to them. Exception storm events have the highest level of severity and come into effect by having the highest level of event count relative to the time window (breach duration) that they are received in. Exception level storm events should be used to inform your users that an event storm has occurred and it is impacting one or more component of your IT infrastructure and it has impacted it with a significant performance degradation or loss of service. It also contains one of the parameters for closing an open event.

:'''Breach Count''': This is the minimum number of events or and duplicates per '''''breach duration''''' that must be exceeded in order to create or change a storm event with the status of exception. While the storm event with a severity of exception is open, as long as this condition is met the storm rule will continue to be in breach. When this condition is not being met then the reset values are checked.

:'''Breach Duration''': This is the time period over which the minimum number of '''''breach count''''' events or and duplicates in order to trigger a storm event with the status of exception.

:'''Reset Count''': If there is no breach condition being met then this is the number that the events or and duplicates must be equal to or less than during the '''''reset duration''''' before the event may be reduced to warning or information.