You can configure the basic and advanced settings for the events burst filter in the advanced vCenter Server settings.

Burst filter can be in the following configurations.

  • Enabled: If compressToDb or compressToSyslog are enabled, then the burst filter detects bursts, posts events for them, and consolidates events before storing them in the database or sending them to the remote syslog server.
  • Disabled: The burst filter does not detect bursts, does not post events for them, and does not consolidate events before storing them in the database or sending them to the remote syslog server. If both compressToDb and compressToSyslog are disabled, then the burst filter detects bursts and posts events for them but does not consolidate events.

Procedure

  1. In the vSphere Client, navigate to the vCenter Server instance.
  2. Select the Configure tab.
  3. Advanced Settings
  4. Click Edit.
  5. In the Filter text box, enter vpxd.event, and press Enter.
  6. For the basic setting,
    1. Enable or disable the vpxd.event.burstFilter.compressToDb option.
      This option enables you to compress the bursting of events in the database. The default value for the setting is enabled.
    2. Enable or disable the vpxd.event.burstFilter.compressToSyslog option.
      This option enables you to compress the bursting of events in the syslog server. The default value for the setting is disabled.
  7. The burst settings are not visible with their default values in Advanced Settings. However, a key-value can be entered for the configuration to take effect.
    Note: Adding or modifying advanced settings might result in an unstable environment. Configuration parameters cannot be removed once they are added.
    1. Configure a key-value to enable the config.vpxd.event.burstFilter.enabled option.
      This parameter enables burst detection of the VC database and syslog. On disabling burst filter, bursts are not detected and the events are stored in the database or remote syslog server by default without compression. The default value is Enabled.
    2. Configure a key-value to enable the config.vpxd.event.burstFilter.rateEvents option.
      You can configure the number of events after which a burst is detected. If the configured limit is reached, the event sequence is considered a burst and is compressed while storing it in the VC database. The default value is 30. If the default is set, then the first 30 events are not compressed. They are used to detect a burst. If a burst is detected, then a single consolidated event with their count replaces the subsequent events after the first 30 events.
      Note: It does not compress the real-time stream of events like alarms and EventManager property collector updates.
    3. Configure a key-value to enable the config.vpxd.event.burstFilter.rateSeconds option.
      This parameter allows you to configure the number of seconds the data is stored for an event from the last time the event occurred. Higher values load the burst filter cache, and the bursts are detected even if the incoming flow of events is not even. Lower values exert lesser load on burst filter cache, and bursts may not be detected if there is a temporary halt of incoming events. The default value is 30 seconds.
    4. Configure a key-value to enable the config.vpxd.event.burstFilter.cacheSize option.
      The number of unique events tracked by the burst filter. When the cache is full, the burst filter stops monitoring the incoming new unique events and passes them through the VC database and syslog. The default value is 128000.
      Note: Setting a lower value than default reduces the memory footprint but it also reduces the capacity to detect bursts for a large inventory.
    5. Configure a key-value to enable the config.vpxd.event.burstFilter.whitelist option.
      You can configure the burst filter to compress all types of events except the events that are on the allow list. This parameter allows you to separate event types. It can avoid in monitoring few event types by the burst filter. The default value is <whiteList>vim.event.UserLoginSessionEvent;vim.event.UserLogoutSessionEvent</whiteList>
    6. Configure a key-value to enable the config.vpxd.event.burstFilter.compressRatio option.
      When the burst filter starts compressing an event, it posts a compressed event when the burst ends or on every X event. If a burst occurs for days, it posts some events instead of muting them all until the burst ends. ​ The default value is 3600. The events are logged every 3600 events.
    Note: Restart the vmware-vpxd service for all changes to take effect. For more information how to restart services in the vSphere Web Client, see vCenter Server and Host Management documentation.