The event burst filter monitors the incoming stream of events for identical events over a short time. To optimize the storage size of events, events that occur repeatedly are consolidated into a single event before storing them in the database or the remote syslog server.

Event bursts can be seen in various scenarios which include,
  • An existing hardware failure.
  • An automated solution which logs-in and logs-out of vCenter Server often.

The events burst filter is enabled by default. It consolidates all types of events except those events on the allow list. An event burst is defined as more than one identical event per second. Two events are identical if,

  • The events are of the same type.
  • The events are on the same inventory object.
  • The events are issued by the same user.
Note: The remaining event-specific data is not used to determine if two events are identical.

An event burst is detected after seeing 30 identical events for less than 30 seconds. These 30 events are stored in the VC database or the remote syslog server. Consolidation of the bursting events starts from the 31st event. The bursting events do not go into the database, but the consolidated event gets stored in the database.

In cases of bursting events, the burst filter affects only the events that go to the database and remote syslog stream. Alarms triggered by bursting events and EventHistoryCollector objects are not affected.
  • com.vmware.vc.EventBurstStartedEvent - the start of an event burst.
  • com.vmware.vc.EventBurstEndedEvent - the end of an event burst.
  • com.vmware.vc.AllEventBurstsEndedEvent - the end of all the events bursts.
  • com.vmware.vc.EventBurstCompressedEvent - the consolidated event after the event burst.
Each of this event contains,
  • eventType - the event type of the bursting event.
  • objectId - the entity of the bursting event.
  • userName - the user name of the bursting event.
Also the compressed event contains,
  • count - the number of identical events since the start of an event burst. The count starts from the 31st event.
  • burstStartTime - Time of the 31st event of an event burst.
    Note: The timestamps of the burst filter events are not related to the bursting events.