What are the different types of events in Active IQ Unified Manager
Applies to
- Active IQ Unified Manager 9.6+
- Oncommand Unified Manager 9.5 and below
Answer
Active IQ Unified Manager has 4 different types of events.
1. Built in events.
- These are a list of events organized by object type such as Aggregate, Cluster, Node, Volumes, etc.
- Examples include things such as Volume Full, Aggregate Full, Storage Failover State events, etc.
- Built in events are further broken down into two categories
- Health Events
-
Health events are notifications that are generated automatically when a predefined condition occurs or when an object crosses a health threshold. These events enable you to take action to prevent issues that can lead to poor performance and system unavailability. Events include an impact area, severity, and impact level.
Health events are categorized by the type of impact area such as availability, capacity, configuration, or protection. Events are also assigned a severity type and impact level that assist you in determining if immediate action is required.
-
-
Performance Events
-
Performance events are incidents related to workload performance on a cluster. They help you identify workloads with slow response times. Together with health events that occurred at the same time, you can determine the issues that might have caused, or contributed to, the slow response times.
When Unified Manager detects multiple occurrences of the same event condition for the same cluster component, it treats all occurrences as a single event, not as separate events.
-
- Health Events
- A full list can be found here.
Example:
2. Active IQ Portal Events
- These are events linked to AIQ.netapp.com.
- Unified Manager can display events that have been discovered by the Active IQ platform. These events are created by running a set of rules against AutoSupport messages generated from all storage systems being monitored by Unified Manager.
- Unified Manager checks for a new rules file automatically and only downloads a new file when there are newer rules. In sites with no external network access, you need to upload the rules manually from .
- Unified Manager will download the latest rules which will be run against each cluster after midnight.
- These will typically be risks associated with clusters. Some will have fix it options or provide suggested actions to fix the issue.
- The event details will show the rule ID that is being checked.
Example:
For more information.
EMS Based Events
- Unified Manager has a large number of the common events that storage administrators may want to alert on. Built in events will not cover every possible scenario that can occur for a cluster. Unified Manager has several hundred events while Ontap has several thousand EMS events.
- To cover events that are not built in, EMS subscription can be used. This allows administrators to configure Unified Manager to receive specific EMS events that can happen on their clusters in real-time. Unified Manager polls on 15 minute intervals so builtin events can be delayed by the polling cycle.
- EMS events come in two forms
- Automatically subscribed events
- Manually subscribed events
3. Automatically Subscribed events
- These are events that are automatically subscribed when a cluster is added to Unified Manager.
- The cluster will notify Active IQ Unified Manager when these events occur via REST notification over 9443.
- The events will appear in the form of <Severity> EMS Received. To see more information for the event you will need to drill into the event details.
- For a list of the automatically subscribed events.
4. Manually subscribed events
- These are events that storage administrators may wish to alert on that are not part of the built in or automatically subscribed events.
- The cluster will notify Unified Manager when these events occur via Syslog over UDP port 514.
- The events will appear in the form of <Severity> EMS Received. To see more information for the event you will need to drill into the event details.
- For more information on configuring EMS based notifications
Example of an EMS event
What happens if a event is triggered
When Unified Manager receives an event, it is displayed in the Dashboard page, in the Event Management inventory page, in the Summary and Explorer tabs of the Cluster/Performance page, and in the object-specific inventory page (for example, the Volumes/Health inventory page).
When Unified Manager detects multiple continuous occurrences of the same event condition for the same cluster component, it treats all occurrences as a single event, not as separate events. The duration of the event is incremented to indicate that the event is still active.
Depending on how you configure settings in the Alert Setup page, you can notify other users about these events. The alert causes the following actions to be initiated:
- An email about the event can be sent to all Unified Manager Administrator users.
- The event can be sent to additional email recipients.
- An SNMP trap can be sent to the trap receiver.
- A custom script can be executed to perform an action.
This workflow is shown in the following diagram.
