Consolidating Similar Events

Consolidation rules group multiple duplicate events from an agent computer into one summary event. Event consolidation provides a combined event to replace many similar events generated in a short time period.

Event consolidation can reduce system stress during an event storm. For example, if a hard disk begins to fail, it might send 100 events each second as failure notification. A consolidation rule could compress all events occurring within 60 seconds into a single event.

The combined, or consolidated, event shows the number of duplicate events that were consolidated during a specified time, and the time of the first and last event that the consolidated event represents.

Microsoft Operations Manger can consolidate events from a single computer. If multiple similar events occur on two computers during the specified time, the individual agents consolidate the events on each computer, resulting in two separate summary events.

Consolidation rules do not generate alerts or define responses. You can create other event rules to generate alerts or provide responses for the consolidated event.