Last Occurrence and Event Count Explained in DX UIM
Article ID: 248545
Updated On:
Products
Issue/Introduction
Since UIM 20.4 CU2, the Operator Console Alarm View Provides a "Last Occurrence" time field. This allows to sort alarms on the latest received.
What does the "Last Occurrence" column in OC Alarm View corresponds to?
What is the reason why the Last occurrence does not consistently increase at every occurrence of an alarm?
Why does Event Count in OC does not increase?
This KB explains what the "Last Occurrence" and Events Count corresponds to in different scenarios.
Environment
DX UIM 20.4 CU2 and later / 23.4.*
Cause
Guidance
Resolution
The "Last Occurrence" is a time formatted information displayed in the OC Alarm viewer and it is taken from the "time" field in the NAS_TRANSACTION_SUMMARY table, in the SQL, ORACLE or MySQL UIM Database.
Read More: Where are the alarms stored in DX UIM? (broadcom.com)
To understand why, in some scenarios, the displayed Last Occurrence time does not correspond to the very last alarm received it is crucial to differentiate between:
- a new alarm that does trigger an event change
New identical alarms of the same type for the same event repeating at a polling period won't trigger an Event change. For example, if we are monitoring a Service every 5 minutes, and that service goes down for one hour, during downtime, we will receive the first alarm; For the next alarms (that will be stored in the NAS_TRANSACTION_LOG) the number of events will not increase and will remain to 1 ("Event" field in the NAS_TRANSACTION_SUMMARY and in NAS_ALARMS).
- a new alarm that does not trigger an event change
For example if a new occurrence arrives but the severity of that alarm is changed, the event number will increase.
The Last Occurrence will always show the Time of the last occurrence that did trigger an event change.
Read more: Some Alarms' "count" increase immediately while others don't even when the alarms are suppressed (broadcom.com)
Below are some "real life" examples in different scenarios:
TEST SCENARIO Part 1 : First occurrence of an Alarm comes in:
In OC the Alarm Viewer shows 1 Event count, and “Last Occurrence” Corresponds to time_arrival (TIME in NAS_TRANSACTION_SUMMARY)
OC and IM:
UIM DB :
TEST SCENARIO Part 2: three additional identical occurrences of the same alarm are received:
Even though the last instance (4th) of the alarm is received at 16.12 IM and OC are still showing the last EVENT time change. Not the last “row” re-occurrence of the same identical alarm.
Consequently OC still show the Last Occurrence from the first time change.
In the DB the NAS_TRANSACTION_LOG has stored 4 alarms. But "time" is not updated in NAS_TRANSACTION_SUMMARY
TEST SCENARIO part 3 : An additional occurrence arrives and but something in the alarm is updated. Eg. Severity is now Critical:
The Last Occurrence timei s now updated (As well as the time received in IM). It now corresponds to the last instance received (which triggered a severity change).
Note that the "Event Count" has increased from 1 to 5. Even though the "Events" field in the NAS_TRANSACTION_SUMMARY has only increased to 2 (this was the second "Event change") the IM and OC "Event counts" are showing 5.
The IM Count and OC Event shows the total number of instances. The total number of instances corresponds to the number of rows in NAS_TRANSACTION_LOG for the same nimid. Or, also, the NAS_ALARMS "suppcount" +1 (the first instance received)
Additional Information
Feedback
