HP support couldn't give me a definitive answer on what happens when that limit is reached, and experience tells me NNMi doesn't seem to handle this very well, and we have witnessed alerts being dropped rather than some form of round-robin, drop the oldest type functionality...
So, you should definitely configure the NNMi auto-trimming of events functionality as described here. I have no idea why HP don't have this set in the GUI, or on by default...
This example is on linux:
cd /var/opt/OV/shared/nnm/conf/props
vi nms-jboss.properties
Uncomment the following line, or copy as I have done, and set to TrimOnly - you can set the archive mode also, just check the required setting and manual to be sure
#!com.hp.nnm.events.snmpTrapAutoTrimSetting=Disabled
com.hp.nnm.events.snmpTrapAutoTrimSetting=TrimOnly
Then set the % of alerts (of the 100k limit) at which the trim operation should start:
#!com.hp.nnm.events.snmpTrapAutoTrimStartPercentage=50
com.hp.nnm.events.snmpTrapAutoTrimStartPercentage=50
Then set the % of alerts to delete during the trim:
#!com.hp.nnm.events.snmpTrapAutoTrimPercentageToDelete=25
com.hp.nnm.events.snmpTrapAutoTrimPercentageToDelete=50
Then run ovstop / ovstart to make the functionality live.
Summary:
100k is the hard limit...
Therefore this process starts trimming at 50% (50k)...
It will trim 50% of the alerts, therefore down from 50k to 25k…
Therefore event levels should always be between 25-50k.
That's what I have seen in testing anyway :-)
