Messages generated by message storm detection
If a message storm is detected, then the message storm detection mechanism creates a high priority message with the following properties.
| Property | Value |
| Severity | Set to the severity as defined with the value "Severity of the message storm begin message" |
| Group | OVO |
| Application | OVO |
| Object | OVOMsgStorm |
| Message key | <MsgKeyPrefix>:TimeCreated:start:<NodeID> Or <MsgKeyPrefix>:TimeReceived:start:<NodeID> |
| Service name | <ServiceName>@@<NodeID> |
| Text | Message storm detected on <NodeName>. Detection was based on the message property <TimeCreated | Time Received>. Node Id: <NodeID> Number of received messages: <Nbr of messages received from affected node> Time interval: <Nbr of seconds> |
NOTE:The output of the automatic and operator-initiated actions is automatically added as annotations to the message and the message reflects the execution states of these actions.
If a message storm is over, then a high priority message with the following properties is created by the message storm detection mechanism.
| Property | Value |
| Severity | Set to the severity as defined with the value "Severity of the message storm end message" |
| Group | OVO |
| Application | OVO |
| Object | OVOMsgStorm |
| Message key | <MsgKeyPrefix>:TimeCreated:end:<NodeID> Or <MsgKeyPrefix>:TimeReceived:end:<NodeID> |
| Service name | <ServiceName>@@<NodeID> |
| Text | Message storm on node <NodeName> is over,
because the number of received messages is below the configured
maximum number. Detection was based on the message property <TimeCreated | Time Received>. Node Id: <NodeID> Configured maximum number of messages: <RecoverCount> Number of received messages: <Nbr of messages received from affected node> Time interval: <Nbr of seconds> |
NOTE:The output of the automatic and operator-initiated actions is automatically added as annotations to the message and the message reflects the execution states of these actions.
Special considerations for detecting the end of message storms
The detection of both the start and the end of message storms is based on analyzing the message flow. However, if your administrator configured automatic actions to stop the agents on the affected nodes, then agents will not send messages until they are restarted, so message flow is stopped.In order to detect the end of message storms when the message flow is stopped, the message storm detection mechanism maintains a list of managed nodes for which a message storm has been detected. This list is checked every five minutes to see whether new messages have arrived from the nodes. If no messages have arrived in the last five minutes and the configured time interval for message storm recovery has passed, then a high priority message is generated to indicate that the message storm is over.
Related Topics: