alarm_enrichment queue is increasing

Products

• DX Unified Infrastructure Management (Nimsoft / UIM)

Issue/Introduction

alarm_enrichment queue is increasing and not processing data quick enough

Environment

UIM 23.4.2
NAS and alarm_enrichment 23.4.2

Cause

A large number of alarms were hitting the pre-processing rules at the same time.

Resolution

Please do the below on the Primary hub:

- disable the Storm Protection ( if enabled) located in Nas Setup 

- add the subscr_block_size to 500 to Nas raw configure

- change the alarm_enrichment queue bulk size to 500 located in the Hub> raw configure> Postroute> alarm_enrichment 

 

Additional Information

In the NAS probe, if the key subscr_block_size is set through rawConfig with a value (e.g., 500), the NAS probe reads alarms or events from the hub queue in bulk (500 at a time) and processes them simultaneously. Otherwise, it reads and processes alarms or events one by one.

updating the subscr_block_size key and the bulk_read_size key in the NAS rawConfig, setting both to a value of 500. This means the AE probe, like the NAS probe, now reads events from the queue in bulk, enabling faster processing.

let the alarm_enrichment queue process all the data and stabilize then feel free to delete the subscr_block_size key from the NAS rawConfig.