Duplicate Event Suppression

A new event may be a duplicate of an existing event. As new events are received, they are checked against existing events. If duplicates are found, new information is used to update the existing event and the new event is ignored.

Suppressing duplicate events is controlled using the Duplicate Events Suppression Settings in the Operations Management Infrastructure Settings and must be enabled before any settings become active.

If duplicate event suppression is enabled, new events that are duplicates of an existing event are not retained and the original event is updated. If the new event includes a key, such as Select CI, a search is made for an existing, active event that has the same key value, in this case the same CI, as the new event. Events must usually be received relatively soon after the original event to be regarded as a possible duplicate. This time period is also a configurable setting.

If the new event does not include a key, a search is made for an existing, active event where a set of configurable attributes have the same values as the new event.

If no original event is found yet, and the new event has a value for an HI, a search is made for an existing, active event that has the same ETI value and the same CI.

Suppressing duplicate events can result in additional correlations of the original event (both as cause and as symptom). When a duplicate is identified, the timestamp for the original event is updated to the time when the duplicate was received. The event is then correlated again and may now be related to other events which were not available for correlation when the original event was received.