IBM Support

What value should be used for Source of PreFilter of Configuration file (.conf) of LFA ?

Question & Answer


Question

What value should be used for Source of PreFilter of Configuration file (.conf) of LFA ?

Answer

You should use the Provider Name for Source of PreFilter.
In the Windows Event Viewer, if the value of the Provider Name started with "Microsoft-Windows-" in the Details tab of an event, "Microsoft-Windows-" are omitted and the rest of the string is displayed in the "Source:" of the General tab of the event. However, LFA gets the value of Source which includes "Microsoft-Windows-" from Windows API, therefore, the Provider Name should be used for Source of PreFilter.
For example, if you saw "DNS-Server-Service" in the "Source:" of the General tab and "Microsoft-Windows-DNS-Server-Service" in the Provider Name in the Details tab in an event, you should use "Microsoft-Windows-DNS-Server-Service" instead of "DNS-Server-Service".

[{"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Product":{"code":"SSTFXA","label":"Tivoli Monitoring"},"Component":"Log File Agent (LFA)","Platform":[{"code":"PF033","label":"Windows"}],"Version":"All Versions","Edition":"","Line of Business":{"code":"LOB45","label":"Automation"}}]

Document Information

Modified date:
30 June 2019

UID

ibm10957917