Administer > Configure Incidents > Configure SNMP Trap Incidents > SNMP Trap Configuration Form > Configure Deduplication for an SNMP Trap Incident

Configure Deduplication for an SNMP Trap Incident

For information about each SNMP Traps tab: Concept Link IconSee Also

The deduplication configuration determines what values NNMi should match to detect when an SNMP Trap Incident, Syslog Message Incident or Management Event Incident is a duplicate.

Note the following:

  • Suppression, Enrichment, and Dampening are not supported for Deduplication incidents.
  • NNMi applies only one deduplication configuration per incident. If NNMi generates an incident using a specified deduplication configuration, NNMi continues to correlate duplicate incidents using the original configuration. To use a different deduplication configuration for an incident, first delete the current deduplication incident (created using the original deduplication configuration). NNMi generates the next deduplication incident according to the new deduplication configuration settings.
  • NNMi continues to update the duplicate count regardless of an incident's lifecycle state. For example, if an incident's Lifecycle State is set to Closed, the duplicate count continues to be incremented.
  • Each time you stop and restart ovjboss, any incidents that have not yet been correlated or persisted are lost. This means that after a restart of ovjboss, an incoming incident might not be correlated as expected. For example, after a restart of ovjboss, a duplicate incident might not be correlated under its original parent incident. Instead, a new parent incident might be generated. See Stop or Start an NNMi Process for more information about starting and stopping the ovjboss process.

  • If a Duplicate Correlation Incident is dampened, note the following:

    • Duplicate Correlation Incidents inherit the Dampening settings from its Correlated Children.

    • NNMi always retains the Parent Duplicate Correlation incident, even if its Child Incidents are Closed and subsequently deleted.

      See Dampening Incident Configurations for more information about Dampening an incident configuration.

To specify or delete a deduplication configuration:

  1. ClosedNavigate to the SNMP Trap Configuration form:
    1. From the workspace navigation panel, select the Configuration workspace.
    2. Expand the Incidents folder.
    3. Select SNMP Trap Configurations.

    4. Do one of the following:

      1. To create a deduplication configuration, click the New icon, and continue.
      2. To edit a deduplication configuration, select a row, click the  Open icon, and continue.
      3. To delete a deduplication configuration, select a row and click the  Delete icon.
  2. Select the Deduplication tab.
  3. Provide the required information (see "Deduplication Attributes" table).
  4. Click  Save and Close to save your changes and return to the previous form.
Deduplication Attributes
Name Description
Enabled

Use this attribute to temporarily disable an incident's deduplication configuration:

Disable  = Temporarily disable the selected configuration.

Enable  = Enable the selected configuration.

After a deduplication configuration is enabled, NNMi increments the Duplicate Count for an associated incident regardless of the Lifecycle State value. For example, if an incident's Lifecycle State is set to Closed, the duplicate count continues to be incremented.

Count

Note By default, NNMi updates the Duplicate Count every 30 seconds. This interval cannot be changed.

Specifies the number of duplicate incidents for the current configuration that NNMi stores at one time. For example, if the Count is 10, after NNMi receives 10 duplicate incidents, NNMi deletes the first (oldest) duplicate incident and keeps the eleventh. (NNMi stores ten maximum.)
Hours

Used with the Minute and Second Intervals to specify the time that must elapse before a new duplicate incident is generated for this incident configuration. For example, if the Hour Interval value is 1, and no Minute or Second Intervals are specified, and the duplicate incident is not generated within one hour, NNMi generates a new duplicate incident the next time it occurs.
Minutes

Used with the Hour and Second interval to specify the time that must elapse before a new duplicate incident is generated for this incident configuration. For example, if the Minute Interval is 30 and no Hour or Second Intervals are specified, and the duplicate incident is not generated within 30 minutes, NNMi generates a new duplicate incident the next time it occurs.
Seconds

Used with the Hour and Minute Intervals to specify the time that must elapse before a new duplicate incident is generated for this incident configuration. For example, if the Second Interval is 120 and no Hour or Minute Intervals are specified, and the duplicate incident is not generated within 120 seconds, NNMi generates a new duplicate incident the next time it occurs.
Parent Incident

Used to specify the Incident Configuration that will be the Parent Incident for the incident you are configuring. For example, you might have created a Management Event Incident Configuration that could be used as the Parent Incident for SNMP Trap Incidents.

When specifying the Parent Incident, you have the following options:

  • When you want to use a configuration that NNMi provides, use the default Duplicate Correlation incident configuration . If you select this option, the incident message for the Parent Incident begins as follows:

    Duplicate Correlation for <incident_configuration_name>

    For example if you are configuring a Node Down incident and select Duplicate Correlation as the Parent Incident, the Parent Incident message begins with: Duplicate Correlation for Node Down. Each Node Down incident that is a duplicate then appears correlated under the Duplicate Correlation for Node Down incident.

  • NNMi also enables you to customize the Parent Incident for a given deduplication scenario. If you have created a Management Event Incident Configuration to use for this deduplication scenario, select the Management Event Incident Configuration that you have created.
Comparison Criteria

Specify the attribute values that must match before the incident is identified as a duplicate. The possible attributes consist of the following choices.

  • Name - The Name attribute value from the Incident form: General tab. 

  • CIA - Represents any of the following items configured as a Parameter Value using the Deduplication Comparison Parameters Form :

    • The Value attribute from the Incident form: Custom Attributes tab
    • An SNMP varbind Object ID

    • An SNMP varbind position number

  • SourceNode - The Source Node attribute value from the Basics attributes listed on the Incident form. The Source Node value is the IP Address or Name of the node for which the incident was generated.

    Note The Source Node must be stored in the NNMi database.

  • Source Object - The Source Object attribute value from the Basics attributes listed on the Incident form.

    Note The Source Object must be stored in the NNMi database.

Caution Each attribute value in the option you select must match before the incident is identified as a duplicate. For example, if you select Name, only the Incident Name value must match. If you select Name SourceNode SourceObject CIA, the Incident Name, Source Node, Source Object, and all Custom Incident Attribute values that you configure as a Parameter Value must match before NNMi identifies the incident as a duplicate.

Selecting an option that includes CIA enables you to further refine the deduplication criteria. For example, you might want to configure deduplication for incidents with CIA values that specify the same State attribute value for a particular network object.

For a description of each Comparison Criteria option, Closedclick here.
Comparison Criteria Description
Name Value of the Name attribute from the Incident form: General tab must match.
Name CIA

Each of the following values must match:

  • Name attribute from the Incident form: General tab

  • CIA - Represents the Value associated with any of the following items configured as a Parameter Value using the Deduplication Comparison Parameters Form

    • Name of a Custom Incident Attribute (CIA) provided by NNMi.
    • An SNMP varbind Object ID

    • An SNMP varbind position number

Name SourceNode

Note Select this option only if the Source Node is stored in the NNMi database.

Each of the following values must match:

  • Name attribute from the Incident form: General tab
  • The Source Node attribute value from the Basics attributes listed on the Incident form
Name SourceNode CIA

Note Select this option only if the Source Node is stored in the NNMi database.

Each of the following values must match:

  • Name attribute from the Incident form: General tab
  • The Source Node attribute value from the Basics attributes listed on the Incident form

  • CIA - Represents the Value associated with any of the following items configured as a Parameter Value using the Deduplication Comparison Parameters Form

    • The Value attribute from the Incident form: Custom Attributes tab
    • An SNMP varbind Object ID

    • An SNMP varbind position number

Name SourceObject

Note Select this option only if the Source Object is stored in the NNMi database.

Each of the following values must match:

  • Name attribute from the Incident form: General tab
  • The Source Object attribute value from the Basics attributes listed on the Incident form.
Name SourceObject CIA

Note Select this option only if the Source Object is stored in the NNMi database.

Each of the following values must match:

  • Name attribute from the Incident form: General tab
  • The Source Object attribute value from the Basics attributes listed on the Incident form

  • CIA - Represents the Value associated with any of the following items configured as a Parameter Value using the Deduplication Comparison Parameters Form

    • The Name attribute from the Incident form: Custom Attributes tab
    • An SNMP varbind Object ID

    • An SNMP varbind position number

Name SourceNode SourceObject

Note Select this option only if the Source Node and Source Object are stored in the NNMi database.

Each of the following values must match:

  • Name attribute from the Incident form: General tab
  • The Source Node attribute value from the Basics attributes listed on the Incident form
  • The Source Object attribute value from the Basics attributes listed on the Incident form
Name SourceNode SourceObject CIA

Note Select this option only if the Source Node and Source Object are stored in the NNMi database.

Each of the following values must match:

  • Name attribute from the Incident form: General tab
  • The Source Node attribute value from the Basics attributes listed on the Incident form
  • The Source Object attribute value from the Basics attributes listed on the Incident form

  • CIA - Represents the Value associated with any of the following items configured as a Parameter Value using the Deduplication Comparison Parameters Form :
Deduplication Comparison Parameters

Optional. If you selected a Comparison Criteria that includes CIA, you must populate one or more rows in this table. See Deduplication Comparison Parameters Form .

Send Help Center feedback