IV67737: DUPLICATE EVENTS SENT BECAUSE LOG DETECTED AS SWITCHED OR RE-CREATED
Fixes are available
Tivoli Log File Agent, Version 6.3.0 Fix Pack 01 (6.3.0-TIV-ITM_LFA-FP0001)
Tivoli Log File Agent, Version 6.3.0 Interim Fix 04 6.3.0-TIV-ITM_LFA-IF0004
Tivoli Log File Agent, Version 6.3.0 Fix Pack 02 (6.3.0-TIV-ITM_LFA-FP0002)
Tivoli Log File Agent, Version 6.3.0 Interim Fix 05 6.3.0-TIV-ITM_LFA-IF0005
Closed as program error.
After applying Log File agent v6.3 IF0003 (6.3.0-TIV-ITM_LFA-IF0003) on AIX and Linux, with NumEventsToCatchUp=-1 set, the monitored log is incorrectly detected as re-created or switched. The monitored log is re-read from the beginning, resulting in duplicate events. Environment: Platforms: Aix, Linux. (This problem does not exist on Windows operating systems.) Log File Agent version: 06.30.00.03 NumEventsToCatchUp=-1 set in .conf file Problem Determination: On the LO agent system, enable a minimum of the following trace KBB_RAS1= ERROR (UNIT:kumpfdp2 ALL) The agent RAS1 log <hostname>_lo_[instance]_kloagent_<timestamp>-<nn>.log shows the following: ... ... <timestamp>:kumpfdp2.c,778,"DoFileTailRestart") Retrieved old monitor filename </tmp/test_lfa.txt> creation time <1411741772> last modification time <1411741772> size <699> ... <timestamp>:kumpfdp2.c,792,"DoFileTailRestart") Comparing creation time <1411743260> last modification time <1411743260> size <758> <timestamp>:kumpfdp2.c,816,"DoFileTailRestart") Note: Monitor file /tmp/test_lfa.txt has been switched or re-created, updating restart file </opt/IBM/ITM/logs/LO_LFA01_LogfileEvents_LogfileEvents_tivoli85 .rst> <timestamp>:kumpfdp2.c,834,"DoFileTailRestart") Per TailRestartFromTop parameter, restarting file monitoring from beginning of file </tmp/test_lfa.txt> ... The file, listed above, is detected as re-recreated based on the file information returned by the operating system: creation time modification time size last <1411741772> <1411741772> <699> current <1411743260> <1411743260 > <758> RECREATE INSTRUCTIONS: On AIX or Linux: 1. Set up "NumEventsToCatchUp=-1" in the .conf file 2. Create 2 events in /tmp/test_lfa.txt 3. Events received as expected 4. Stop the LO agent 5. Create 3 new events in /tmp/test_lfa.txt 6. Start the LO Agent *** Expected behavior: Last 3 events *** Actual behavior: All 5 events sent.
In the .conf file: set NumEventsToCatchUp = 0
With NumEventsToCatchUp=-1 set in the conf file, the monitored log is incorrectly detected as re-created or switched. The monitored log is re-read from the beginning, resulting in duplicate events. This issue occurs on AIX, Linux after applying Log File Agent v6.3 IF0003 (6.3.0-TIV-ITM_LFA-IF0003). It does not exist on Windows operating systems.
Check file creation time on Windows only. The fix for this APAR is included in the following maintenance vehicle: | interim fix | 6.3.0-TIV-ITM_LFA-IF0004 available at http://www.ibm.com/support/docview.wss?uid=swg24039388
Reported component name
ITM LOG FILE AG
Reported component ID
Last modified date
APAR is sysrouted FROM one or more of the following:
APAR is sysrouted TO one or more of the following:
Fixed component name
ITM LOG FILE AG
Fixed component ID
Applicable component levels