IBM Support

What value should be used for Source of PreFilter of Configuration file (.conf) of LFA ?

Question/Answer


Question

What value should be used for Source of PreFilter of Configuration file (.conf) of LFA ?

Answer

You should use the Provider Name for Source of PreFilter.

In the Windows Event Viewer, if the value of the Provider Name started with "Microsoft-Windows-" in the Details tab of an event, "Microsoft-Windows-" are omitted and the rest of the string is displayed in the "Source:" of the General tab of the event. However, LFA gets the value of Source which includes "Microsoft-Windows-" from Windows API, therefore, the Provider Name should be used for Source of PreFilter.

For example, if you saw "DNS-Server-Service" in the "Source:" of the General tab and "Microsoft-Windows-DNS-Server-Service" in the Provider Name in the Details tab in an event, you should use "Microsoft-Windows-DNS-Server-Service" instead of "DNS-Server-Service".

Document information

More support for: IBM Tivoli Monitoring V6

Component: Log File Agent (LFA)

Software version: All Versions

Operating system(s): Windows

Reference #: 0957917

Modified date: 30 June 2019