Technote (troubleshooting)
Problem(Abstract)
TEC logfile adapter is resending old events that were already processed by TEC
Symptom
TEC adapter is monitoring several logsources. Once in a while, old events from one of the monitored logsource are re-sent
Cause
One of the logs monitored was periodically truncated. By default, a monitored logsource is considered as new if the filesize change. By truncating the log, the adapter treated the logsource as new and the remaining events were re-sent to TEC. See also parameter 'NewLogBasedOn' in the adapter's guide.
Resolving the problem
Do not truncate existing logs. Either erase logs completely or use rotating logs.
Rate this page:
Copyright and trademark information
IBM, the IBM logo and ibm.com are trademarks of International Business Machines Corp., registered in many jurisdictions worldwide. Other product and service names might be trademarks of IBM or other companies. A current list of IBM trademarks is available on the Web at "Copyright and trademark information" at www.ibm.com/legal/copytrade.shtml.