Alert Compression / Noise Reduction in Oracle Enterprise Manager 13c

🧠 What is “Alert Compression”?

OEM doesn’t use the exact term “compression” officially, but in practice it means:

👉 Reducing duplicate, repetitive, or noisy alerts into fewer meaningful alerts

---

⚡ Why It’s Needed

Without this:

• Same issue → 100+ alerts

• DBAs get flooded

• Real issues get missed

With alert compression:

• Duplicate alerts → grouped / suppressed

• Only actionable alerts remain

---

🔧 Key Features That Enable Alert Compression

1️⃣ Incident Rules (Event Compression Engine)

👉 Core mechanism behind alert reduction

What it does:

• Groups multiple events into a single incident

• Prevents duplicate alerts

Example:

• 10 tablespace alerts
  ➡️ 1 incident instead of 10 alerts

---

2️⃣ Event De-duplication

OEM automatically:

• Detects same event repeating

• Suppresses repeated notifications

👉 Example:

• “CPU high” every minute
  ➡️ Only one alert generated

---

3️⃣ Event Correlation

👉 Combines related alerts into one

Example:

• DB down

• Listener down

• Host down

➡️ OEM shows one root incident

---

4️⃣ Metric Threshold Suppression

👉 Avoids alert flapping

How:

• Warning/Critical thresholds

• Clear condition required before re-alert

---

5️⃣ Blackouts (Temporary Alert Suppression)

👉 Used during maintenance

Patch window → No alerts triggered

---

6️⃣ Notification Rules Filtering

👉 Only send alerts when needed

• Based on severity

• Based on target

• Based on time

---

7️⃣ Corrective Actions (Auto-Healing)

👉 Prevents repeated alerts

Example:

• Listener down
  ➡️ Auto restart script
  ➡️ No repeated alerts

---

📊 Real Example (Before vs After)

❌ Without Alert Compression:

• 50 alerts for:

  • Tablespace full

  • CPU spike

  • Session blocking

---

✅ With OEM Features:

• 1 incident for tablespace

• 1 incident for CPU

• 1 incident for blocking

👉 Huge noise reduction

---

🎯 Best Practices (Production)

✅ 1. Use Incident Rules

• Group related alerts

• Define severity properly

---

✅ 2. Tune Thresholds

Avoid:

• Too sensitive alerts

• Too many false positives

---

✅ 3. Enable Blackouts

During:

• Patching

• Maintenance

---

✅ 4. Use Corrective Actions

Automate:

• Restart services

• Clear temp issues

---

🧠 Interview Questions

---

❓ What is alert compression in OEM?

Answer:

It is the process of reducing duplicate or repetitive alerts using incident rules, event correlation, and suppression mechanisms.

---

❓ How does OEM avoid alert flooding?

Answer:

• Incident rules

• Event de-duplication

• Threshold tuning

• Blackouts

---

❓ What is the difference between Event and Incident?

Event	Incident
Raw alert	Grouped actionable alert
Many	Few

---

❓ How do you reduce alert noise in OEM?

Answer:

• Tune thresholds

• Configure incident rules

• Use blackout

• Enable auto corrective actions

---

🚀 Final Thought

“A good DBA doesn’t monitor more alerts…
They monitor fewer, smarter alerts.”

---