Using Log Throttling To Reduce Duplicate Event Log And Snmp Messages; Log Throttle Periods - HP Aruba JL253A Management And Configuration Manual

Using log throttling to reduce duplicate Event Log and SNMP messages

A recurring event can generate a series of duplicate Event Log messages and SNMP traps in a relatively short
time. As a result, the Event Log and any configured SNMP trap receivers may be flooded with excessive, exactly
identical messages. To help reduce this problem, the switch uses log throttle periods to regulate (throttle)
duplicate messages for recurring events, and maintains a counter to record how many times it detects duplicates
of a particular event since the last system reboot.
When the first instance of a particular event or condition generates a message, the switch initiates a log throttle
period that applies to all recurrences of that event. If the logged event recurs during the log throttle period, the
switch increments the counter initiated by the first instance of the event, but does not generate a new message.
If the logged event repeats again after the log throttle period expires, the switch generates a duplicate of the first
message, increments the counter, and starts a new log throttle period during which any additional instances of the
event are counted, but not logged. Thus, for a particular recurring event, the switch displays only one message in
the Event Log for each log throttle period in which the event reoccurs. Also, each logged instance of the event
message includes counter data showing how many times the event has occurred since the last reboot. The switch
manages messages to SNMP trap receivers in the same way.

Log throttle periods

The length of the log throttle period differs according to an event's severity level:
Severity level
I (Information)
W (Warning)
D (Debug)
M (Major)
Example:
Suppose that you configure VLAN 100 on the switch to support PIM operation, but do not configure an IP
address. If PIM attempts to use VLAN 100, the switch generates the first instance of the following Event Log
message and counter.
NOTE:
In The first instance of an event message and counter on page 502 the counter (1) indicates
that this is the first instance of this event since the switch last rebooted.
The first instance of an event message and counter
W 10/01/12 09:00:33 PIM:No IP address configured on VID 100 (1)
502
Log throttle period
6000 Seconds
600 Seconds
60 Seconds
6 Seconds
Aruba 2930F / 2930M Management and Configuration Guide
for ArubaOS-Switch 16.08