Best practice for creating LFA agent configuration file

Body

The Tivoli Log File Agent (LFA) is an agent that provides a configurable log file monitoring capability that uses regular expressions. This regular expression statements are located in format file (fmt).

The Tivoli Log File Agent uses a configuration file that contains configuration options and filters. You create this configuration file and configure the agent instance to use it. Since this is fully user´s customizable agent you must follow some guidelines to avoid high CPU or memory usage while using the agent.

1. If possible use LogSources tag instead of RegexLogSources
2. FileComparisonMode tag has huge impact when you are monitoring many custom logs specified under LogSources tag. Make sure that FileComparisonMode=CompareByLastUpdate is set. This way the file with the most recent last update timestamp is monitored.
3. Do not set PollInterval tag too intense. Best way is to do couple of test and see which value is most appropriate for your environment.
4. PreFilter and PreFilterMode is also very effective to decrease agent performance but unfortunately can be used only for windows event logs monitoring
5. NumEventsToCatchUp make sure that your agent is at latest version or maintenance level. If NumEventsToCatchUp=-1 you can face many issues.

When you creating LFA instance for the first time please also review Best practice for creating LFA agent format file blog entry.

In LFA agent installation image also contain example conf and fmt files which are located under <Image_Dir>\examples\ folder.

Having problems with installation and configuration LFA agent? Look no further, review How to install IBM Tivoli Log File Agent V6.3 and do basic configuration to recieve data in TEP?

Subscribe and follow us for all the latest information directly on your social feeds: