The event burst filter monitors the incoming stream of events for identical events over a short time. To optimize the storage size of events, events that occur repeatedly are consolidated into a single event before storing them in the database or the remote syslog server.
- An existing hardware failure.
- An automated solution which logs-in and logs-out of vCenter Server often.
The events burst filter is enabled by default. It consolidates all types of events except those events on the allow list. An event burst is defined as more than one identical event per second. Two events are identical if,
- The events are of the same type.
- The events are on the same inventory object.
- The events are issued by the same user.
An event burst is detected after seeing 30 identical events for less than 30 seconds. These 30 events are stored in the VC database or the remote syslog server. Consolidation of the bursting events starts from the 31st event. The bursting events do not go into the database, but the consolidated event gets stored in the database.
EventHistoryCollectorobjects are not affected.
com.vmware.vc.EventBurstStartedEvent- the start of an event burst.
com.vmware.vc.EventBurstEndedEvent- the end of an event burst.
com.vmware.vc.AllEventBurstsEndedEvent- the end of all the events bursts.
com.vmware.vc.EventBurstCompressedEvent- the consolidated event after the event burst.
eventType- the event type of the bursting event.
objectId- the entity of the bursting event.
userName- the user name of the bursting event.
count- the number of identical events since the start of an event burst. The count starts from the 31st event.
burstStartTime- Time of the 31st event of an event burst.Note: The timestamps of the burst filter events are not related to the bursting events.