IBM Support

How to install IBM Tivoli Log File Agent V6.3 and do basic configuration to receive data in TEP?

Technical Blog Post


Abstract

How to install IBM Tivoli Log File Agent V6.3 and do basic configuration to receive data in TEP?

Body

Download IBM Tivoli Log File Agent V6.3 from Passport Advantage site

IBM Tivoli Log File Agent (LFA) V6.3, Multiplatform, Multilingual
Part Number: CIGM5ML

Note:  Upgrading to the v6.3 of the KLO agent is not dependent on a v6.3 infrastructure. The minimum pre-req is 6.2.2 FP2.

Extract image to your temporary directory. After that navigate to <temp_dir>\WINDOWS\ and execute setup.exe file to start installation wizard.

When installation wizard starts proceed with Next:  

Read prerequisites and proceed with Next:

Confirm license agreement with Next (Scrshot show license agreement in Slovenian language):

Review setting and proceed with Next:

Confirm installation with Yes button:

Select Log File Agent and proceed with Next:

Select setup type and proceed with Next. You can reconfigure agent also after installation.


Because I selected "Configure agents default connections...", following window appears where you configure communication protocol, Tivoli Enterprise Monitoring Server location, and other settings. Proceed with OK.

When installation / configuration ends finish installation with Finish button.

After successful installation, the Manage Tivoli Enterprise Monitoring Service (MTEMS) window opens where you can see LFA agent template from which you create agent instances.

To create an instance, right click in LFA template and select Configure Using Defaults in menu:

Enter a Unique instance name. I named my instance Test-Inst:

In next window specify agent parameters like conf and fmt file location, if events are sent to IBM Tivoli Monitoring or OMNIbus by using EIF (or maybe both). In this blog I configure agent to use example conf and fmt files, which are provided with agent installation image. They are located under /examples folder. I uploaded example configuration files (regex1.conf and regex1.fmt) at the end of this blog. If you are using Autodiscovery feature, you can leave Conf file and Format File parameters empty. Proceed with Next

Configure Global setting (if needed), and finish configuration with OK.

Conf file modification. Point LogSources tag to your monitored custom log. Set UnmatchLog tag to file to capture messages that do not match a pattern in the fmt file. On Windows systems, you can also specify Event logs that you want to be monitored by using WINEVENTLOGS tag. Snippet from regex1.conf file:

# Files to monitor.  The single file /tmp/regextest.log, or any file like /tmp/foo-1.log or /tmp/foo-a.log.
LogSources=C:\test.log

# If more than one file matches the pattern /tmp/foo-?.log above, monitor only the newest one
FileComparisonMode=CompareByLastUpdate

# Any records in the monitored log that do NOT match a pattern in the fmt are written here
UnmatchLog=C:\regextest.un

# Monitor the named event logs on Microsoft Windows.  The latter two require Windows 2008 or higher,
# and the fourth one requires the Hyper-V role.
WINEVENTLOGS=System,Security,Application,Microsoft-Windows-Hyper-V-Worker-Admin,Microsoft-Windows-TaskScheduler-Operational

Format that matches messages containing Error: message. Snippet from regex1.fmt file:

// Matches a simple error message like:
//
//  Error: disk full
REGEX REBase
Error: (.*)
msg $1
END

After successful configuration and modification of example conf and fmt files start agent:

After agent startup, you can see agent online in the Tivoli Enterprise Portal. From default workspace, you can see whether all data collectors started with no Errors and status of monitored files that were specified in LogSources

To verify whether agent reads and matches monitored log messages correctly, navigate to Logfile Events workspace:

After updating Test.log file with "Error: Disk Full" entry you can see that agent matched event with REGEX REBase format is seen in agent workspace. You can also see that agent is reading messages from Windows Event logs:

Example configuration files that are also located in LFA installation image under /examples folder.

regex1.conf|View Detailsregex1.fmt|View Details

When you are creating an LFA instance for the first time, also review Best practices for creating LFA agent format file and Best practices for creating LFA agent configuration file blog entries.

[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSVJUL","label":"IBM Application Performance Management"},"Component":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"","Edition":"","Line of Business":{"code":"LOB45","label":"Automation"}}]

UID

ibm11277380