The event burst filter monitors the incoming stream of events for identical events over a short time. To optimize the storage size of events, events that occur repeatedly are consolidated into a single event before storing them in the database or the remote syslog server.

Event bursts can be seen in various scenarios which include,
  • An existing hardware failure.
  • An automated solution which logs-in and logs-out of vCenter Server often.

The events burst filter is enabled by default. It consolidates all types of events except those events on the allow list. An event burst is defined as more than one identical event per second. Two events are identical if,

  • The events are of the same type.
  • The events are on the same inventory object.
  • The events are issued by the same user.
Note: The remaining event-specific data is not used to determine if two events are identical.

An event burst is detected after seeing 30 identical events for less than 30 seconds. These 30 events are stored in the VC database or the remote syslog server. Consolidation of the bursting events starts from the 31st event. The bursting events do not go into the database, but the consolidated event gets stored in the database.

In cases of bursting events, the burst filter affects only the events that go to the database and remote syslog stream. Alarms triggered by bursting events and EventHistoryCollector objects are not affected.
  • com.vmware.vc.EventBurstStartedEvent - the start of an event burst.
  • com.vmware.vc.EventBurstEndedEvent - the end of an event burst.
  • com.vmware.vc.AllEventBurstsEndedEvent - the end of all the events bursts.
  • com.vmware.vc.EventBurstCompressedEvent - the consolidated event after the event burst.
Each of this event contains,
  • eventType - the event type of the bursting event.
  • objectId - the entity of the bursting event.
  • userName - the user name of the bursting event.
Also the compressed event contains,
  • count - the number of identical events since the start of an event burst. The count starts from the 31st event.
  • burstStartTime - Time of the 31st event of an event burst.
    Note: The timestamps of the burst filter events are not related to the bursting events.

Configure Events Burst Filter

You can configure the basic and advanced settings for the events burst filter in the advanced vCenter Server settings.

Burst filter can be in the following configurations.

  • Enabled: If compressToDb or compressToSyslog are enabled, then the burst filter detects bursts, posts events for them, and consolidates events before storing them in the database or sending them to the remote syslog server.
  • Disabled: The burst filter does not detect bursts, does not post events for them, and does not consolidate events before storing them in the database or sending them to the remote syslog server. If both compressToDb and compressToSyslog are disabled, then the burst filter detects bursts and posts events for them but does not consolidate events.

Procedure

  1. In the vSphere Client, navigate to the vCenter Server instance.
  2. Select the Configure tab.
  3. Advanced Settings
  4. Click Edit.
  5. Click on the filter text box present in the Name column of the table header. Type vpxd.event, and press Enter.
  6. For the basic setting,
    1. Enable or disable the vpxd.event.burstFilter.compressToDb option.
      This option enables you to compress the bursting of events in the database. The default value for the setting is enabled.
    2. Enable or disable the vpxd.event.burstFilter.compressToSyslog option.
      This option enables you to compress the bursting of events in the syslog server. The default value for the setting is disabled.
  7. The burst settings are not visible with their default values in Advanced Settings. However, a key-value can be entered for the configuration to take effect.
    Note: Adding or modifying advanced settings might result in an unstable environment. Configuration parameters cannot be removed once they are added.
    1. Configure a key-value to enable the config.vpxd.event.burstFilter.enabled option.
      This parameter enables burst detection of the VC database and syslog. On disabling burst filter, bursts are not detected and the events are stored in the database or remote syslog server by default without compression. The default value is Enabled.
    2. Configure a key-value to enable the config.vpxd.event.burstFilter.rateEvents option.
      You can configure the number of events after which a burst is detected. If the configured limit is reached, the event sequence is considered a burst and is compressed while storing it in the VC database. The default value is 30. If the default is set, then the first 30 events are not compressed. They are used to detect a burst. If a burst is detected, then a single consolidated event with their count replaces the subsequent events after the first 30 events.
      Note: It does not compress the real-time stream of events like alarms and EventManager property collector updates.
    3. Configure a key-value to enable the config.vpxd.event.burstFilter.rateSeconds option.
      This parameter allows you to configure the number of seconds the data is stored for an event from the last time the event occurred. Higher values load the burst filter cache, and the bursts are detected even if the incoming flow of events is not even. Lower values exert lesser load on burst filter cache, and bursts may not be detected if there is a temporary halt of incoming events. The default value is 30 seconds.
    4. Configure a key-value to enable the config.vpxd.event.burstFilter.cacheSize option.
      The number of unique events tracked by the burst filter. When the cache is full, the burst filter stops monitoring the incoming new unique events and passes them through the VC database and syslog. The default value is 128000.
      Note: Setting a lower value than default reduces the memory footprint but it also reduces the capacity to detect bursts for a large inventory.
    5. Configure a key-value to enable the config.vpxd.event.burstFilter.whitelist option.
      You can configure the burst filter to compress all types of events except the events that are on the allow list. This parameter allows you to separate event types. It can avoid in monitoring few event types by the burst filter. The default value is <whiteList>vim.event.UserLoginSessionEvent;vim.event.UserLogoutSessionEvent</whiteList>
    6. Configure a key-value to enable the config.vpxd.event.burstFilter.compressRatio option.
      When the burst filter starts compressing an event, it posts a compressed event when the burst ends or on every X event. If a burst occurs for days, it posts some events instead of muting them all until the burst ends. ​ The default value is 3600. The events are logged every 3600 events.
    Note: Restart the vmware-vpxd service for all changes to take effect. For more information how to restart services in the vSphere Client, see vCenter Server and Host Management documentation.