Reducing Duplicate Event Log And Snmp Trap Messages - HP ProCurve 6400cl Series Management And Configuration Manual

N o t e
Reducing Duplicate Event Log and SNMP Trap
Messages
This feature is available with all software releases for the Series 3400cl and
Series 6400cl switches and with software release E.08.xx and greater on the
Series 5300xl switches. Initially it applies only to Event Log messages and
SNMP traps generated by the PIM software module.
A recurring event can generate a series of duplicate Event Log messages and
SNMP traps in a relatively short time. This can flood the Event Log and any
configured SNMP trap receivers with excessive, exactly identical messages.
To help reduce this problem, the switch uses log throttle periods to regulate
(throttle) duplicate messages for a given recurring event, and maintains a
counter to record how many times it detects duplicates of a particular event
since the last system reboot. That is, when the first instance of a particular
event or condition generates a message, the switch initiates a log throttle
period that applies to all recurrences of that event. If the logged event recurs
during the log throttle period, the switch increments the counter initiated by
the first instance of the event, but does not generate a new message. If the
logged event repeats again after the log throttle period expires, then the switch
generates a duplicate of the first message, increments the counter, and starts
a new log throttle period during which any additional instances of the event
are counted, but not logged. Thus, for a particular, recurring event, the switch
displays one instance of the corresponding message in the Event Log for each
successive log throttle period applied to recurrences of that event. Also, each
logged instance of the event message includes counter data showing how
many times the event has occurred since the last reboot. The switch manages
messages to SNMP trap receivers in the same way.
The log throttle period for an event depends on the event's severity level:
Severity Log Throttle Period
I (Information) 6000 Seconds
W (Warning) 600 Seconds
M (Major) 6 Seconds
D (Debug) 60 Seconds
Example of Log Message Throttling. For example, suppose that you con-
figure VLAN 100 on the switch to support PIM operation, but do not configure
an IP address. If PIM attempted to use VLAN 100, the switch would generate
the first instance of the following Event Log message and counter.
Using the Event Log To Identify Problem Sources
Troubleshooting
C-31