## About the Event Life-Cycle

Most storage network events are based on health transitions. For example, a health transition occurs when the state of a device goes from online to offline. It is the transition from online to offline that generates an event, not the actual offline value. If the state alone were used to generate events, the same events would be generated repeatedly. Transitions cannot be used for monitoring log files, so log events can be repetitive. To minimize this problem, attach thresholds to entries in the log files.

The software includes an event maximums database that keeps track of the number of events generated about the same subject in a single eight-hour time frame. This database prevents the generation of repetitive events. For example, if the port of a switch toggles between offline and online every few minutes, the event maximums database ensures that this toggling is reported only once every eight hours instead of every five minutes.

Event generation usually follows this process:

1. The first time a device is monitored, a discovery event is generated. It is not actionable but is used to set a monitoring baseline, primarily for the Network Storage Command Center (NSCC). When NSCC is enabled, a discovery event is generated to re-establish the monitoring baseline. This event describes, in detail, the components of the storage device. Every week after a device is discovered, an audit event is generated with the same content as the discovery event.
2. A log event can be generated when interesting information is found in host or storage log files. This information is usually associated with storage devices and sent to all users. These events can be made actionable based on thresholds, and then sent using the Net Connect provider, if enabled.
3. Events are generated when the software detects a change in the content of the instrumentation report, probes the device, and compares the report to the last instrumentation report, which is usually only minutes old. StateChangeEvent and ValueChangeEvent categories represent most of the events that are generated.
4. When possible, the master agent combines events to generate aggregated events.
   Note: Aggregated events and events that require action by service personnel (known as actionable events) are also referred to as alarms. Some alarms are based on a single state change and others are a summary of events where the event determined to be the root cause is advanced to the head of the queue as an alarm. The supporting events are grouped under the alarm and are referred to as aggregated events.

### Related Topics

- About Monitoring Strategy
- About the Monitoring Cycle