This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Event Overload - Volume index changed from x to x on servers with giant netapp storage volumes masking events that make sense to see through all this...

With the massive netapp storage I have I'm getting literally thousands of these Volume Index Changed messages all day long from every server that mounts the volumes...  this really causes information overload in the events list masking other information you might want to see... trying to decide how to deal with this:

    1/10/2013 10:20 AM   servername-/vobstore/****- Volume index changed from 430 to 428
    1/10/2013 10:20 AM   servername-/vobstore/****- Volume index changed from 429 to 427
    1/10/2013 10:20 AM   servername-/vobstore/****- Volume index changed from 428 to 426
    1/10/2013 10:20 AM   servername-/vobstore/****- Volume index changed from 427 to 425
    1/10/2013 10:20 AM   servername-/vobstore/****- Volume index changed from 426 to 424
    1/10/2013 10:20 AM   servername-/vobstore/****- Volume index changed from 425 to 423
    1/10/2013 10:20 AM   servername-/vobstore/****- Volume index changed from 423 to 421
    1/10/2013 10:20 AM   servername-/vobstore/****- Volume index changed from 422 to 420
    1/10/2013 10:20 AM   servername-/vobstore/****- Volume index changed from 421 to 419
    1/10/2013 10:20 AM   servername-/vobstore/****- Volume index changed from 420 to 418
    1/10/2013 10:20 AM   servername-/vobstore/****- Volume index changed from 397 to 395
    1/10/2013 10:20 AM   servername-/vobstore/****- Volume index changed from 396 to 394
    1/10/2013 10:20 AM   servername-/vobstore/****- Volume index changed from 419 to 417
    1/10/2013 10:20 AM   servername-/vobstore/****- Volume index changed from 418 to 416
    1/10/2013 10:20 AM   servername-/vobstore/****- Volume index changed from 417 to 415
    1/10/2013 10:20 AM   servername-/vobstore/****- Volume index changed from 416 to 414
    1/10/2013 10:20 AM   servername-/vobstore/****- Volume index changed from 415 to 413
    1/10/2013 10:20 AM   servername-/vobstore/****- Volume index changed from 410 to 408
    1/10/2013 10:20 AM   servername-/vobstore/****- Volume index changed from 409 to 407
    1/10/2013 10:20 AM   servername-/vobstore/****- Volume index changed from 387 to 385
    1/10/2013 10:20 AM   servername-/vobstore/****- Volume index changed from 386 to 384
    1/10/2013 10:20 AM   servername-/vobstore/****- Volume index changed from 385 to 383
    1/10/2013 10:20 AM   servername-/vobstore/****- Volume index changed from 384 to 382
    1/10/2013 10:20 AM   servername-/vobstore/****- Volume index changed from 383 to 381
    1/10/2013 10:20 AM   servername-/vobstore/****- Volume index changed from 382 to 380
    1/10/2013 10:20 AM   servername-/vobstore/****- Volume index changed from 381 to 379
    1/10/2013 10:20 AM   servername-/vobstore/****- Volume index changed from 380 to 378

Note servername and volume names have been removed.  This is such a small sample of how much this happens all day long and fills the database which it's handling but geesh this is insane!!!

  • I mean look at this:

    Event Summary

    Event Type      10423 Volume Remapped

    Event Type      246      Volume Added

    Event Type      55        Volume Disappeared

    Event Type      55        Volume Reappeared

    Event Type      52        Node Rebooted

    Event Type      42        Node Down

    Event Type      42        Node Up

    Event Type      38        SAM Hardware Sensor Up

    Event Type      25        Node Changed

    Event Type      23        Polling Method Changed

    Event Type      16        Group Members Changed

    Event Type      15        Volume Removed

    Event Type      9          SAM Hardware Type Up

    Event Type      4          Interface Changed

    Event Type      2          Group Warning

    Event Type      2          Group Up

    Event Type      1          Interface Added

    Event Type      1          NetFlow Event

    Event Type      1          SAM Hardware Undefined

    Event Type      1          SAM Hardware Up

  • Someone has to have seen this b4 :^}

    This is a see the forest for the trees kinda problem... or however that saying goes.

  • open a case with NetApp on their SNMP support

    They should try and generate a stable index in the MIB for their volumes. The number they generate doesn't need to be sequential but they should  make it stable over time. Note: The current behavior will break almost anything that uses table index values to monitor statistics on the volume.

    /RjL

  • Thanks Richard so much for response... I can't believe I'm the only one here with NPM and large NetApp NAS's they are trying to monitor.  Here's just one server with mounted netapp storage's event summary... this is INSANE!

    Event Summary

    Event Type11305 Volume Remapped
    Event Type10 Volume Disappeared
    Event Type9 Volume Reappeared

    Am I really the only one with large NetApp volumes being mapped to servers?????

    This is for ONE server above.  Check out my event summary in general today:

    Event Summary

    Event Type18329 Volume Remapped
    Event Type57 Volume Reappeared
    Event Type56 Volume Disappeared
    Event Type3 Interface Changed
    Event Type2 Group Warning
    Event Type2 Group Up
    Event Type2 Node Changed
    Event Type1 Node Up
    Event Type1 Node Rebooted
    Event Type1 NetFlow Event

    For now my solution is to change EventTypes.Record flag from 1 to 0 for Volume Changed in the database.

  • I changed the flag for recording all three event types now in the database for volume remapped, volume reappeared, and volume disappeared.  Not ideal but all I can do right now until something changes with agent or the way NPM handles them.  I'm using my UnDP for netapps and custom alerts so I can monitor my NetApps without relying on this flood of events or letting them clog my event stream.  Now as long as I don't miss other non-NetApp volumes having problems since I'm effectively not recording any of these events any longer...