IBM Support

origin DEFAULT in fmt files is substituted with an unexpected IP address

Technote (troubleshooting)


origin DEFAULT in format files of LFA is sometimes substituted with an unexpected IP addresses depending on name resolution settings.


For example, 'origin' field of events forwarded to EIF probe is filled with an unexpected IP address when DEFAULT is set as 'origin' like the following format file.

This symptom occurs when the machine on which LFA is installed has multiple IP addresses or when duplicate entries exist in /etc/hosts.

FORMAT Logfile_Base
%t %s %s*
date $1
hostname $2
msg $3
origin DEFAULT


LFA gets IP addresses via getaddrinfo() when DEFAULT is set in 'origin' field. LFA uses the first IP address when getaddrinfo() returns multiple IP addresses, but it may not be what the user wants to use.

Resolving the problem

1. Make the host unique in /etc/hosts

Modify /etc/hosts for the host to be resolved uniquely.

2. Set CDP_IP_ADDR in the configuration file of LFA
Users can fix the IP address by setting CDP_IP_ADDR parameter in the configuration file of LFA.

UNIX / Linux:



Document information

More support for: IBM Tivoli Monitoring V6
Tivoli Log File Agent

Software version: 6.2.2, 6.2.3

Operating system(s): AIX, Linux, Windows

Reference #: 1624825

Modified date: 06 January 2016