Hi,
Regarding alarm storm protection, and specifically, the alarm grouping, is it possible that the amount of grouped alarms is greater than the number of alarms that the system can possibly generate?
Practical Example: Parameter in a trap table is alarmed when the raise trap is received. This alarm is not automatically cleared and has a Hysteresis Off configured for 10 seconds. This means that DataMiner will hold off 10 seconds after the clear trap is received before clearing the alarm.
The trap table has a fixed number of entries (say 1000 for instance).
Grouping Configs: Start delaying above 250 alarms; Stop delaying below 240 alarms;
Is it possible that we have 15000 alarms grouped in a storm at any given moment?
Thanks.
Hi Bruno,
The alarmstorm protection will take all active alarms into account. In case Cube notices at least 2000 alarms (depending on your settings) with the same parameter description, they will be grouped. In your case you should have 143638 active alarms with the parameter description “Ingress/UpStream Noise”.
Note that an update of an existing alarm is considered as an alarm which is grouped as well. For example : You have 2000 alarms which are grouped and one of them gets an update, than you will have 2001 alarms grouped. So, yes it is possible to have 15000 alarms grouped, even if the table itself only contains 1000 entries.
Hi Bruno,
We are indeed using the individual alarm IDs and not the root alarm IDs.
When an alarm goes back to the normal state, it depends on the status of the alarm what will happen with the grouped alarm. If you have a grouped alarm of 1000 alarms and one of the alarm drops to the normal state and its status is clearable, the grouped alarm will have 1001 alarms. However if the alarm drops back to the normal state and its status is cleared, the grouped alarm will have 999 alarms. Once an alarm is cleared we don’t count these alarms (and its updates) into the grouped alarm anymore.
Hi Michael,
Thank you.
So if for instance we have 1000 grouped alarms and one of those is updated with a new severity level, for instance, the count of grouped alarms will now be 1001. The reference here is not the number of root alarm Ids, but rather the number of individual Alarm IDs?
Following this train of thought: If we have 1000 alarms, one of those is set to “Normal” severity, and then, before the Hyst Off period expires, it goes back into Critical State, we will have 1001 alarms grouped? Or otherwise, the “Normal” update will also be accounted for and we’ll have 1002 alarms grouped?