IV67737: DUPLICATE EVENTS SENT BECAUSE LOG DETECTED AS SWITCHED OR RE-CREATED

Tivoli Log File Agent, Version 6.3.0 Fix Pack 01 (6.3.0-TIV-ITM_LFA-FP0001)
Tivoli Log File Agent, Version 6.3.0 Interim Fix 04 6.3.0-TIV-ITM_LFA-IF0004
Tivoli Log File Agent, Version 6.3.0 Fix Pack 02 (6.3.0-TIV-ITM_LFA-FP0002)
Tivoli Log File Agent, Version 6.3.0 Interim Fix 05 6.3.0-TIV-ITM_LFA-IF0005

APAR status

• Closed as program error.

Error description

• After applying Log File agent v6.3 IF0003
  (6.3.0-TIV-ITM_LFA-IF0003) on AIX and Linux, with
  NumEventsToCatchUp=-1 set, the monitored log is incorrectly
  detected as
  re-created or switched.  The monitored log is re-read from the
  beginning, resulting in duplicate events.
  
  Environment:
  
  Platforms: Aix, Linux. (This problem does not exist on Windows
  operating
  systems.)
  
  Log File Agent version:  06.30.00.03
                           NumEventsToCatchUp=-1 set in .conf file
  
  Problem Determination:
  On the LO agent system, enable a minimum of the following trace
  KBB_RAS1= ERROR (UNIT:kumpfdp2 ALL)
  
  The agent RAS1 log
  <hostname>_lo_[instance]_kloagent_<timestamp>-<nn>.log shows the
  following:
  ...
  ...
  <timestamp>:kumpfdp2.c,778,"DoFileTailRestart") Retrieved old
  monitor filename </tmp/test_lfa.txt> creation time <1411741772>
  last
  modification time <1411741772> size <699>
  ...
  <timestamp>:kumpfdp2.c,792,"DoFileTailRestart") Comparing
  creation
  time <1411743260> last modification time <1411743260> size <758>
  <timestamp>:kumpfdp2.c,816,"DoFileTailRestart") Note: Monitor
  file
  /tmp/test_lfa.txt has been switched or re-created, updating
  restart file
  </opt/IBM/ITM/logs/LO_LFA01_LogfileEvents_LogfileEvents_tivoli85
  .rst>
  <timestamp>:kumpfdp2.c,834,"DoFileTailRestart") Per
  TailRestartFromTop parameter, restarting file monitoring from
  beginning
  of file </tmp/test_lfa.txt>
  ...
  
  The file, listed above, is detected as re-recreated based on the
  file
  information returned by the operating system:
               creation time     modification time       size
  last         <1411741772>      <1411741772>            <699>
  current      <1411743260>      <1411743260 >           <758>
  
  RECREATE INSTRUCTIONS:
  
  On AIX or Linux:
  
  1. Set up "NumEventsToCatchUp=-1" in the .conf file
  2. Create 2 events in /tmp/test_lfa.txt
  3. Events received as expected
  4. Stop the LO agent
  5. Create 3 new events in /tmp/test_lfa.txt
  6. Start the LO Agent
  
  *** Expected behavior: Last 3 events
  *** Actual behavior:  All 5 events sent.
  

Local fix

• In the .conf file: set NumEventsToCatchUp = 0
  

Problem summary

• With NumEventsToCatchUp=-1 set in the conf file, the monitored
  log is incorrectly detected as re-created or switched.  The
  monitored log is re-read from the beginning, resulting in
  duplicate events.
  
  This issue occurs on AIX, Linux after applying Log File Agent
  v6.3 IF0003 (6.3.0-TIV-ITM_LFA-IF0003). It does not exist on
  Windows operating systems.
  

Problem conclusion

• Check file creation time on Windows only.
  
  The fix for this APAR is included in the following maintenance
  vehicle:
  
  | interim fix | 6.3.0-TIV-ITM_LFA-IF0004
  
  available at
  http://www.ibm.com/support/docview.wss?uid=swg24039388
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  ITM LOG FILE AG

• Fixed component ID

  5724C04LF

Applicable component levels

• R630 PSY

     UP