Fixes are available
Tivoli Log File Agent, Version 6.3.0 Fix Pack 01 (6.3.0-TIV-ITM_LFA-FP0001)
Tivoli Log File Agent, Version 6.3.0 Interim Fix 04 6.3.0-TIV-ITM_LFA-IF0004
Tivoli Log File Agent, Version 6.3.0 Fix Pack 02 (6.3.0-TIV-ITM_LFA-FP0002)
Tivoli Log File Agent, Version 6.3.0 Interim Fix 05 6.3.0-TIV-ITM_LFA-IF0005
APAR status
Closed as program error.
Error description
After applying Log File agent v6.3 IF0003 (6.3.0-TIV-ITM_LFA-IF0003) on AIX and Linux, with NumEventsToCatchUp=-1 set, the monitored log is incorrectly detected as re-created or switched. The monitored log is re-read from the beginning, resulting in duplicate events. Environment: Platforms: Aix, Linux. (This problem does not exist on Windows operating systems.) Log File Agent version: 06.30.00.03 NumEventsToCatchUp=-1 set in .conf file Problem Determination: On the LO agent system, enable a minimum of the following trace KBB_RAS1= ERROR (UNIT:kumpfdp2 ALL) The agent RAS1 log <hostname>_lo_[instance]_kloagent_<timestamp>-<nn>.log shows the following: ... ... <timestamp>:kumpfdp2.c,778,"DoFileTailRestart") Retrieved old monitor filename </tmp/test_lfa.txt> creation time <1411741772> last modification time <1411741772> size <699> ... <timestamp>:kumpfdp2.c,792,"DoFileTailRestart") Comparing creation time <1411743260> last modification time <1411743260> size <758> <timestamp>:kumpfdp2.c,816,"DoFileTailRestart") Note: Monitor file /tmp/test_lfa.txt has been switched or re-created, updating restart file </opt/IBM/ITM/logs/LO_LFA01_LogfileEvents_LogfileEvents_tivoli85 .rst> <timestamp>:kumpfdp2.c,834,"DoFileTailRestart") Per TailRestartFromTop parameter, restarting file monitoring from beginning of file </tmp/test_lfa.txt> ... The file, listed above, is detected as re-recreated based on the file information returned by the operating system: creation time modification time size last <1411741772> <1411741772> <699> current <1411743260> <1411743260 > <758> RECREATE INSTRUCTIONS: On AIX or Linux: 1. Set up "NumEventsToCatchUp=-1" in the .conf file 2. Create 2 events in /tmp/test_lfa.txt 3. Events received as expected 4. Stop the LO agent 5. Create 3 new events in /tmp/test_lfa.txt 6. Start the LO Agent *** Expected behavior: Last 3 events *** Actual behavior: All 5 events sent.
Local fix
In the .conf file: set NumEventsToCatchUp = 0
Problem summary
With NumEventsToCatchUp=-1 set in the conf file, the monitored log is incorrectly detected as re-created or switched. The monitored log is re-read from the beginning, resulting in duplicate events. This issue occurs on AIX, Linux after applying Log File Agent v6.3 IF0003 (6.3.0-TIV-ITM_LFA-IF0003). It does not exist on Windows operating systems.
Problem conclusion
Check file creation time on Windows only. The fix for this APAR is included in the following maintenance vehicle: | interim fix | 6.3.0-TIV-ITM_LFA-IF0004 available at http://www.ibm.com/support/docview.wss?uid=swg24039388
Temporary fix
Comments
APAR Information
APAR number
IV67737
Reported component name
ITM LOG FILE AG
Reported component ID
5724C04LF
Reported release
630
Status
CLOSED PER
PE
NoPE
HIPER
NoHIPER
Special Attention
NoSpecatt
Submitted date
2014-12-10
Closed date
2015-02-26
Last modified date
2015-02-26
APAR is sysrouted FROM one or more of the following:
APAR is sysrouted TO one or more of the following:
Fix information
Fixed component name
ITM LOG FILE AG
Fixed component ID
5724C04LF
Applicable component levels
R630 PSY
UP
[{"Line of Business":{"code":"LOB45","label":"Automation"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSTFXA","label":"Tivoli Monitoring"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"630"}]
Document Information
Modified date:
30 December 2022