Archive and Delete Incidents

To keep NNMi performing at a high level, NNMi drops incoming SNMP traps (including syslog messages), regardless of life-cycle state, after storing a specific number of SNMP traps in its database. You can use the auto-trim oldest SNMP trap incidents feature to control the number of SNMP traps (and syslog messages) stored in the NNMi database and to retain important incoming SNMP traps. For more information, see the "Configuring the Auto-Trim Oldest SNMP Trap Incidents Feature" section of the "Maintaining NNMi" chapter in the Network Node Manager i Software Deployment Reference.

Note NNMi trims only non-root cause SNMP Trap incidents.

To ensure that all incidents are archived, use Incident Logging. When using Incident Logging, NNMi logs an incident as soon as it is persisted, even if it is subsequently deleted. If you use the auto-trim oldest SNMP trap incidents feature instead, some incidents might not be archived. For example, if an incident is deleted while Dampened between the specified auto-trim interval, NNMi keeps no record of that incident.

NNMi enables you to archive and remove incidents that you no longer want to track. For example, this feature is useful if you want to purge the database of incidents that are older than a specified time period or date. Use the nnmtrimincidents.ovpl command to create a comma-separated-values (CSV) file containing the history of incidents, and then trim the volume of incidents to manage the size of your database.

To archive and then delete incidents in NNMi, use the nnmtrimincidents.ovpl command. You can choose to only archive or only delete your incidents as described in the arguments table that follows.

When archiving and deleting incidents, for the best performance results, archive and delete your incidents frequently to keep the size of the NNMi database as small as possible.

SNMP traps are a subset of NNMi incidents ( see -origin in the arguments table that follows). NNMi monitors the volume of SNMP traps that are stored in the NNMi database. The maximum allowed number of SNMP traps is 100,000. Note the following:

• After 90 percent of the maximum limit for SNMP traps is reached or exceeded, NNMi generates an incident with Severity set to Warning to notify you that NNMi is approaching the maximum limit.

• After 95 percent of the maximum limit for SNMP traps is reached or exceeded, NNMi generates an incident with Severity set to Major to notify you that NNMi is approaching the maximum limit. In addition, NNMi only accepts traps required for Causal Engine analysis until the number of SNMP traps within the database has been reduced using the nnmtrimincidents.ovpl command.
• After the maximum SNMP trap limit is reached or exceeded, NNMi generates an incident with Severity set to Critical. NNMi no longer accepts any SNMP traps until the number of SNMP traps within the database has been reduced using the nnmtrimincidents.ovpl command.

Use the nnmtrimincidents.ovpl command to archive and delete your incidents based on any of the attributes described in the following table. See the nnmtrimincidents.ovpl command for more information, including a complete list of arguments for this command.

nnmtrimincidents.ovpl Arguments

Incident Attribute	Description
-archiveOnly	Specifies that you want to only archive incidents rather than archive and then delete them.
-trimOnly	Specifies that you want to only delete incidents rather than archive and then delete them. Note By default, NNMi trims incidents without archiving them.
-trimAndArchive	Specifies that you want to archive incidents before deleting them.
-date	The date must be entered in the following ISO 8601 format: <yyyy-mm-dd>T<hh>:<mm>:<ss>[Z,-<hh>:<mm>,+<hh>:<mm>] ISO Date Format: yyyy — Four-digit year mm — Two-digit month dd — Two-digit day hh — Two digits representing the hour (00 through 23) mm — Two digits representing the minutes (00 through 59) ss — Two digits representing the seconds (00 through 59) +<hh>:<mm> — Local time zone which is the hours (<hh>) and minutes (<mm>) ahead of Coordinated Universal Time -<hh>:<mm> — Local time zone which is the hours (<hh>) and minutes (<mm>) behind Coordinated Universal Time For example: 2007-11-05T08:15:30-5:00 corresponds to November 5, 2007, 8:15:30 am, Eastern Standard Time. Note You must specify either a -age or a -date value.
-age	The age of the incident specified in number of hours, days, weeks, or months. Note You must specify either a -age or a -date value.
-family	The incident Family.
-incr	The increment value that helps determine the -age value. Supported increments include hours, days, weeks, and months. The default increment value is days.
-path	Specifies the archive file name, including the complete path. The default archive file name is (see Manage environment variables for more information): <date> is the date in yyyy-mm-dd format <ms> is milliseconds Windows: %NnmDataDir%\tmp\incidentArchive.<date>.<ms>.csv.gz Linux: $NnmDataDir/tmp/incidentArchive.<date>.<ms>.csv.gz Note Each time you generate an archive, NNMi  appends it to an existing file with the same name, if any. Therefore, to ensure that all archive files are preserved, provide a unique archive file name each time you want to archive incidents.
-lifecycle	Optional:Identifies where the incident is in the incident lifecycle. Possible values are Registered, InProgress, Completed, and Closed.
-name	Identifies the name of the incident configuration.
-nature	Optional: Identifies the nature of the incident. Possible values are: Info, None, RootCause, SecondaryRootCause, ServiceImpact, Dedup_Stream_Correlation, Rate_Stream_Correlation, StreamCorrelation, and Symptom.
-origin	Identifies the Origin of the incident configuration. Possible values are: ManagementSoftware, ManuallyCreated, RemotelyGenerated, SNMPTrap, Syslog, and Other.
-u	The user name required to run this command. This user name must be a valid NNMi user name with a role of either Administrator or System. Note The user name might be a Principal object stored in the NNMi database or might be from Lightweight Directory Access Protocol (LDAP) or X.509 Certificates such as Public Key Infrastructure (PKI) user authentication in your environment. See Choose a Mode for NNMi Access.
-p	The associated password for the user name specified by the -u attribute value. If you do not want to enter an NNMi User Name attribute value and an NNMi Password attribute value at the command line, you can use the nnmsetcmduserpw.ovpl command to specify the valid user name and password (instead of -u and -p). The credentials set using the nnmsetcmduserpw.ovpl command are valid for command execution by the same user.
-quiet	Use this argument when you want to trim incidents without requiring user prompts and responses. (Status information appears.)
-sysobjectid	The industry standard SNMP system object ID (RFC 1213, MIB-II sysObjectID value that identifies vendor/make/model of a device) assigned to the incident configuration. For SNMP Trap incidents, this value is obtained from the incoming SNMP trap. For Management Event incidents generated by NNMi, the system OID is assigned by NNMi.

For example, delete all incidents with lifecycle equal to Closed and age equal to or greater than 1 month.

nnmtrimincidents.ovpl -age 1 -incr months -lifecycle Closed -u <NNMiadminUsername> -p <NNMiadminPassword>

You can also specify a batch size when archiving or deleting incidents. Specify the maximum number of incidents to delete at one time within a single database transaction. This number then determines how often you see a status message that the deletions are complete. Using the default value of 1,000 as an example, NNMi displays a status message after successfully deleting each 1,000 incidents.