IBM Support

IV67737: DUPLICATE EVENTS SENT BECAUSE LOG DETECTED AS SWITCHED OR RE-CREATED

Subscribe

You can track all active APARs for this component.

APAR status

  • Closed as program error.

Error description

  • After applying Log File agent v6.3 IF0003
    (6.3.0-TIV-ITM_LFA-IF0003) on AIX and Linux, with
    NumEventsToCatchUp=-1 set, the monitored log is incorrectly
    detected as
    re-created or switched.  The monitored log is re-read from the
    beginning, resulting in duplicate events.
    
    Environment:
    
    Platforms: Aix, Linux. (This problem does not exist on Windows
    operating
    systems.)
    
    Log File Agent version:  06.30.00.03
                             NumEventsToCatchUp=-1 set in .conf file
    
    Problem Determination:
    On the LO agent system, enable a minimum of the following trace
    KBB_RAS1= ERROR (UNIT:kumpfdp2 ALL)
    
    The agent RAS1 log
    <hostname>_lo_[instance]_kloagent_<timestamp>-<nn>.log shows the
    following:
    ...
    ...
    <timestamp>:kumpfdp2.c,778,"DoFileTailRestart") Retrieved old
    monitor filename </tmp/test_lfa.txt> creation time <1411741772>
    last
    modification time <1411741772> size <699>
    ...
    <timestamp>:kumpfdp2.c,792,"DoFileTailRestart") Comparing
    creation
    time <1411743260> last modification time <1411743260> size <758>
    <timestamp>:kumpfdp2.c,816,"DoFileTailRestart") Note: Monitor
    file
    /tmp/test_lfa.txt has been switched or re-created, updating
    restart file
    </opt/IBM/ITM/logs/LO_LFA01_LogfileEvents_LogfileEvents_tivoli85
    .rst>
    <timestamp>:kumpfdp2.c,834,"DoFileTailRestart") Per
    TailRestartFromTop parameter, restarting file monitoring from
    beginning
    of file </tmp/test_lfa.txt>
    ...
    
    The file, listed above, is detected as re-recreated based on the
    file
    information returned by the operating system:
                 creation time     modification time       size
    last         <1411741772>      <1411741772>            <699>
    current      <1411743260>      <1411743260 >           <758>
    
    RECREATE INSTRUCTIONS:
    
    On AIX or Linux:
    
    1. Set up "NumEventsToCatchUp=-1" in the .conf file
    2. Create 2 events in /tmp/test_lfa.txt
    3. Events received as expected
    4. Stop the LO agent
    5. Create 3 new events in /tmp/test_lfa.txt
    6. Start the LO Agent
    
    *** Expected behavior: Last 3 events
    *** Actual behavior:  All 5 events sent.
    

Local fix

  • In the .conf file: set NumEventsToCatchUp = 0
    

Problem summary

  • With NumEventsToCatchUp=-1 set in the conf file, the monitored
    log is incorrectly detected as re-created or switched.  The
    monitored log is re-read from the beginning, resulting in
    duplicate events.
    
    This issue occurs on AIX, Linux after applying Log File Agent
    v6.3 IF0003 (6.3.0-TIV-ITM_LFA-IF0003). It does not exist on
    Windows operating systems.
    

Problem conclusion

Temporary fix

Comments

APAR Information

  • APAR number

    IV67737

  • Reported component name

    ITM LOG FILE AG

  • Reported component ID

    5724C04LF

  • Reported release

    630

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt

  • Submitted date

    2014-12-10

  • Closed date

    2015-02-26

  • Last modified date

    2015-02-26

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

  • Fixed component name

    ITM LOG FILE AG

  • Fixed component ID

    5724C04LF

Applicable component levels

  • R630 PSY

       UP



Document information

More support for: IBM Tivoli Monitoring V6
Tivoli Log File Agent

Software version: 630

Reference #: IV67737

Modified date: 26 February 2015