Technical Blog Post
Abstract
Troubleshooting Event Losses when testing Tivoli EIF probe with Log File Agent(LFA)
Body
Description:
1. When load testing large number of events sent from Log File Agent(LFA) to Tivoli EIF probe, the following scenario can be seen on random occurrences from OMNIbus EventList:
a. Gradual loss of event while some event continues to arrive at the probe successfully.
b. Active probe stops receiving events although more events were expected.
2. Preparation of events to be sent from LFA to probe involved the following files:
a. LFA Agent's Log Source File - Contains events to be send.
b. LFA Agent's Cache File - Queued/Buffered events during sending process.
- LFA Agent's Log Source file is first populated with events.
Eg: Property name of file can be set in the ".conf" file
RegexLogSources=\tmp\data\myevent_source.log
- During sending LFA Agent's "Cache File" contains buffered/queued events to be sent.
Eg: Property name of file can be set in the ".conf" file
BufEvtPath=\tmp\cache\myevent_source.cache
Problem Observation from LFA Agent's Cache File:
- Logs indicating LFA agent starts to discard/drop events. Results in 1(a) above.
- Followed by a mention of the cache file is corrupted, if it gets worse over time. Results in 1(b) above.
Resolution:
To re-run/re-send data, clean up & re-create files:
a. Remove LFA Agent's Log Source File & LFA Agent's Cache File
b. Re-Create LFA Agent's Log Source File
Additional Notes:
Increasing memory of JVM in machine where LFA is installed helps.
UID
ibm11082151