Challenge
Particular interest for ways of event filtering.
To present vCenter events to HP Operations manager, nworks has first to collect them from the vCenter. By default nworks 5.6 (and earlier versions) collects all events starting with those of "Verbose" severity. It is considered to be safer for nworks and vCenter operation (see KB article "Failure at event filter creation" for details).
Cause
There may be, however certain reasons for not collecting events with "Verbose" severity level: it reduces the total amount of captured events and mitigates the traffic back to collector (there have been cases, when the Customers were concerned with this).
Solution
There are 3 levels of event filtering:
1. VC side. Only used in case of VCVerboseFiltering ON. nworks sends VC event list from "vcEvents.xml" as a parameter to create eventFilter on VC side. It means that VC will only return events present in this list. This method, however, could lead to severe performance issues with VC DB and can not be used on some environments (big environments are especially prone to being affected by this).
2. Collector side. nworks gets ALL events of the last interval, but sends into Operations Manager only events present in "vcEvents.xml" (independent of their severity). Other events will be suppressed. Although nworks gets all events of the last interval, it should not lead to DB overload since no subqueries (or indexes) should be applied on VC side.
3. HP Agent side. Events are present in "vcEvents.xml" and sent to Operations Manager but filtered by suppression rules.
Removing events from "vcEvents.xml" will drop events on the collector side not loading HP Agent, but all event will be gathered from VC in this scenario.