QUESTION:
What Is The Difference Between Test Event And Message Event?
RESOLUTION:
There are two types of events that is shown on Traverse Event Manager. A Threshold Violation (aka Test Event) event is generated when a test status changes from one severity to another in response to a threshold being crossed. For example, assume Round Trip Time test is configured with warning threshold of 30 (ms) and critical threshold of 90. For the following sequence of polled results:
10:15am - 25 ms
10:20am - 20 ms
10:35am - 37 ms
10:40am - 42 ms
10:45am - 20 ms
10:50am - 120 ms
a threshold violation event will be recorded at 10:35am when the test status changes from OK to WARNING. The result at 10:40am will not generate an event since the test status remain same (WARNING) until at 10:45am when it returns to OK. So a second event is recorded at 10:45am. Finally, another event will be recorded at 10:50am as the test status goes from OK to CRITICAL.
Threshold Violation events are generated by the DGE and comparison of polled (numerical) values against configured thresholds. In contrast, Message Events are generated by the Message Handler component. This is the second type of event that corresponds to textual information collected from external sources. This includes SNMP trap, Windows Event Log, Syslog, local log files, etc. As an SNMP trap or Windows Event Log is accepted by the corresponding event source of Message Handler, it is evaluated against configured Event Processing Rules. These rules control whether to accept/reject the trap/log based on comparison against a pattern (regular expression). If accepted, the rule also defines how to transform the event data, what severity to assign to the resulting message event, whether the event should remain visible on the Event Manager for a fixed period of time, etc.
The display filter on the Event Manager allows control over which type of events are shown. The default state of this filter can be configured in each user's preference.
