## Event Life-Cycle

Most of the Storage Automated Diagnostic Environment events are based on health transitions. When, for example, the state of a device goes from 'online' to 'offline' , a health transition occurs. It is the transition from 'offline' to 'online' that generates an event, not the actual value 'offline'. If the state alone was used to generate events, the same events would be generated all the time. Transitions cannot be used when monitoring logfiles, so log events can be very repetitive. This problem is minimized by attaching thresholds to entries in the logfiles.

Thresholds ensure that a minimum number (up to eight) of logfile entries within a certain time period occur before an event is generated. The Storage Automated Diagnostic Environment also includes an event maximums database that keeps track of the number of events generated about the same subject in the same 8-hour timeframe. This database is used to stop the generation of repetitive events when there is no other way to do it. For example, if the port of a switch was toggling between offline and online every few minutes, the event maximums database would ensure that this toggling is reported only once every 8 hours instead of every five minutes.

### Related Topics

- Customizing a Host Event Log
- Email and Event Maximums
- Thresholds List

Events are usually generated using the following rules:

1. The first time a device is monitored, a discovery event is generated. It is not actionable and it is used to set a monitoring baseline, primarily for NSCC. This event describes, in detail, the components of the storage device. Every week after discovery, an audit event is generated. It has the same content as the discovery event.
2. A log event can be generated when interesting information is found in host or storage logfiles. This information is usually associated with storage devices and sent to all users. These events can be made actionable based on thresholds, and then sent using the Net Connect provider.
3. Events are generated when the software detects a change in the content of the instrumentation report, probes the device, and compares the report to the last instrumentation report (which is usually only minutes old). StateChangeEvent and TopologyEvent categories represent most of the events that are generated.

### Related Topics

- Using the Event Advisor

- When possible, the Storage Automated Diagnostic Environment master agent combines events to generate aggregated events.
  Note: Aggregated events, as well as events that require action by service personnel (known as actionable events) might also be referred to as alarms.

### Related Topics

- Optimization and Fault Symptom Analysis