Owner's Manual

30 Hardware, Operating Systems and Ports Used
Hard drive space requirements listed here, and other hardware requirements are based on expected
maximum use for average installations and are only intended to be an approximate guide.
NOTE:
This software version is not compatible with Windows NT.
Trap Processing Speeds
The following describes event processing speeds for the mediation service, the portion of this
application that communicates directly with the devices under management, and the application
server, which receives events from the mediation service, processes them, and formats them so that
a client can view them. The nominal sustainable rate and a burst rate are two variations on these
performance numbers. The sustainable rate is what is expected during normal operation.
This application typically does not lose traps as they come in. It can handle the burst rate, but only
for a short period falls behind and events are backed up. This is standard behavior for Event
Monitoring systems.
Application server inserts event data into the database, updates alarm states in the database,
executes propagation logic, and executes any necessary automation. Besides handling incoming
events, application server also handles client requests from event or alarm views and these result in
database queries.
NOTE:
The performance of the database significantly effects event processing.
Mediation is a service running in the application server. The mediation service correlates events
against the inventory model, applies event filtering, and determines what actions, if any, should
execute for an event. When events come into the system, from any protocol, they queue for
processing by mediation. At regular intervals, mediation submits processed events to the
application server for more processing against the database. The remaining queued events wait
while the current batch is being committed.
The application immediately converts SNMP traps into events and then queues them for
mediation. It handles syslog differently, spooling all messages on disk first and then discarding or
escalating them to event status. By default, all syslog messages are escalated. Handling a large
volume of events may involve some analysis of the events coming in and modifications to event
definitions and processing rules.