$('a[name]').remove(); $('#ic-homepage__footer').before('

'); $("#tabs").tabs({ selected: 1 }); $("#ic-homepage__ic-tips").append( quickTipHTML() ); unhideOneProductTip(); $("#ic-homepage__product-tips").wrapInner('

'); $("#ic-homepage__feed-tips").wrapInner('

'); });

IBM Tivoli Monitoring > Version 6.3 > User's Guides > Log File Agent User's Guide > Event filtering and summarization IBM Tivoli Monitoring, Version 6.3


Detecting and filtering duplicate events

You can configure the Tivoli Log File Agent to handle duplicate events.

To alleviate the problem of multiple duplicate events, You define what constitutes a duplicate event using the DupDetectionKeyAttributes tag in the .conf file. In a comma-separated list, you include one or more defined IBM Tivoli Monitoring attributes that you want to use to determine whether an event is considered a duplicate. In the following example, events with the same message and the same CustomSlot1 are to be considered duplicates:

Duplicate events are detected from IBM Tivoli Monitoring attributes. Therefore, if you want detection of duplicates to be based on particular slots that you defined, complete the following steps:

  1. Map the slot value to an IBM Tivoli Monitoring attribute.

  2. Map that IBM Tivoli Monitoring attribute to the DupDetectionKeyAttributes tag in the .conf file.

Use the following example, where the important slots, eventclass and eventid, are mapped to CustomSlot1 and CustomSlot2:

if you want to specify certain events as duplicate events, in the .conf file, map the IBM Tivoli Monitoring attributes to the DupDetectionKeyAttributes tag as shown here:

  1. The CustomSlot attribute names are case-sensitive and so you must enter the names exactly as shown in the preceding example.

  2. If you do not provide a list of attributes, the values are defaulted to Class and Logname.

The events where these attributes match are considered to be duplicate events by the agent.

Since the duplicate detection is global, it is good practice to pick a set of custom slots to use as keys and use them this way in all format statements. For example, use slots 1-3 for keys. If a format needs only one key but also needs more slots, use slot one to contain the name value and slots four to n to contain the other data.


Parent topic:

Event filtering and summarization

+

Search Tips   |   Advanced Search