Use the Event Journal tab on the Root Group Form to manage number of acceptable Event Journal records. There are two sections provided to manage these records.
Overactive - Stream
The Overactive - Stream section allows you to enable or disable and define a warning limit for the number of Event Journal records that you expect to be created per hour.
In addition you can set the maximum number of records stored in a granule. Once a granule reaches the maximum size all further records for the granule are discarded.
Use the following fields to enable or disable and define the Event Journal record limits:
Use the Severity combo box to select the Severity Level. This is the severity of the alarm that you want ClearSCADA to display in event messages when the number of records within a granule that are created per hour reaches the number defined in the Warning and Maximum fields. You can disable the alarms by setting the Severity to None, in which case the Warning field is grayed out.
This field is only displayed if the Area of Interest feature is enabled on your system. Use the field to specify the Area of Interest with which overactive alarms are to be associated (see Assign a Different Area of Interest to an Item's Alarms and Events).
Enter the number of Event Journal records per granule per hour that raise a warning alarm. If the number of records in an individual granule reaches this number an alarm is raised to indicate that the granule is overactive. The minimum value you can enter is 500 records or 0 to disable the feature. The default value is 14,400 records / hour (4 records / second for an hour).
This default is provided to avoid false alarms and data loss on large systems.
For this feature to be effective you need to specify values appropriate for your system, to avoid problems before a warning is generated.
The Warning alarm message indicates which granule is overactive including both the time and the filename.
"Too many event journal records (# records in hour beginning <time>) file <filename>"
When an alarm is triggered, the alarm source indicates which stream contains the overactive granule (if streams are enabled).
"Event Journal (Stream #)"
The Warning field is unavailable and grayed out if the Severity is set to None.
Enter the maximum number of Event Journal records per granule per hour that can be logged. If the number of records in an individual granule reaches this number an alarm is raised to indicate that the granule has reached the maximum value and no more events will be logged for the objects in this stream for the remainder of this period. The minimum value you can enter is equal to the Warning number of records or 500 if alarms are disabled or 0 to disable the feature. The default value is 115,200 records/hour (32 records/second for an hour).
This default is provided to avoid false alarms and data loss on large systems.
For existing systems a review should be done of the number of events which are logged in an hour and then a value picked from that. The defaults are based on the operational limits of ClearSCADA. So when increasing the limit should consider that it may have a performance impact on your system.
Lowering the maximum number of records below the size of existing granules prevents any further records being added to those granules, it does not affect the existing records in those granules.
The Maximum alarm message indicates which granule was overactive and is now full including both the time and the filename.
"Too many event journal records, granule is full (# records in hour beginning <time>) file <filename>"
When an alarm is triggered, the alarm source indicates which stream contains the overactive granule (if streams are enabled).
"Event Journal (Stream #)"
If the Severity field is set to None, no alarm is raised when the Maximum number of records is reached.
LOSS OF DATA
Overactive - Object
The Overactive - Object section allows you to enable or disable and define a warning limit for the number of Event Journal records per database item (object) that you expect to be created per hour.
In addition you can set the maximum number of records stored per database item. When the number of records reaches the maximum size all further records for the object are discarded.
Use the following fields to enable or disable and define the Event Journal record limits:
Use the Severity combo box to select the Severity Level. This is the severity of the alarm that you want ClearSCADA to display in event messages when the number of records for an object that are created per hour reaches the number defined in the Warning and Maximum fields. You can disable the alarms by setting the Severity to None, in which case the Warning field is grayed out.
This field is only displayed if the Area of Interest feature is enabled on your system. Use the field to specify the Area of Interest with which overactive alarms are to be associated (see Assign a Different Area of Interest to an Item's Alarms and Events).
Enter the number of Event Journal records per database item per hour that raise a warning alarm. If the number of records in an individual object reaches this number an alarm is raised to indicate that the granule is overactive. The minimum value you can enter is 250 records or 0 to disable the feature. The default value is 7,200 records / hour (2 records / second for an hour).
This default is provided to avoid false alarms and data loss on large systems.
For this feature to be effective you need to specify values appropriate for your system, to avoid problems before a warning is generated.
The Warning alarm message indicates which database item is overactive including both the time and the filename.
"Warning: High event count (# records in hour beginning <time>) file <filename> Alarm raised"
When an alarm is triggered, the alarm source indicates which stream contains the overactive granule.
"Event Journal (Object #)"
The Warning field is unavailable and grayed out if the Severity is set to None.
Enter the maximum number of Event Journal records per database item per hour that can be logged. If the number of records for an individual item reaches this number an alarm is raised to indicate that the granule has reached the maximum value and no more events will be logged for the item for the remainder of this period. A fleeting alarm is raised with an associated event, to warn the user that any further events that occur in the current hour are suppressed.
The minimum value you can enter is equal to the Warning number of records or 250 if alarms are disabled or 0 to disable the feature. The default value is 57,600 records/hour (16 records /second for an hour).
This default is provided to avoid false alarms and data loss on large systems.
For existing systems a review should be done of the number of events which are logged in an hour and then a value picked from that. The defaults are based on the operational limits of ClearSCADA. So when increasing the limit you should consider that it may have a performance impact on your system
Lowering the maximum number of records below the size of existing objects prevents any further records being added for those objects, it does not affect the existing records in those items.
The Maximum alarm message indicates which object was overactive and is now full including both the time and the filename.
"Too many events (<count> records in hour beginning <time>). Logging Suppressed - Alarm raised"
When an alarm is triggered, the alarm source indicates which item contains the overactive granule.
"Warning: High event count (<count> records in hour beginning <time>)""
If the Severity field is set to None, no alarm is raised when the Maximum number of records is reached.
LOSS OF DATA
If the limits are increased on the root group properties they do not take immediately and suppression will continue at the previous limits (for items with counts above limits) until a new hour boundary, see Unsuppress Event Logging.
When the Event Journal becomes overactive:
- Review the events list to determine which item(s) are generating large numbers of messages.
- Check the Status of the objects, see Events
- Check for any automated processes (for example, logic programs) that are performing any actions repeatedly and incorrectly (for example, caught in a loop).
- Check or change the stream size (so that fewer objects per stream are generated), see Define the Stream Size for Maximum Performance.
-
Check for faulty sensors on devices (outstations) which maybe causing excessive state changes.