Just a quick pointer on an issue that comes up from time to time. If you are using the Tivoli Log File Agent to send log events directly to OMNIbus through its EIF probe, the underlying EIF library will buffer your events in a cache file. This ensures they are not lost if the receiver is down for a time, and provides temporary storage if the events are being generated faster than the receiver can accept them. The library imposes a maximum size on this file, however, to prevent it from growing out of control and using too much space. But if the events come in too quickly, and the cache file fills, events could then be lost. This issue is compounded by the fact that the default maximum is a rather low 64KB. Most users can easily increase this to 10MB or more now, and this gives you a lot more cushion to get through sudden storms of events, or periods when connectivity to the EIF probe is lost for whatever reason.
To change this, just set the value BufEvtMaxSize in your agent's .conf file. It takes a numeric value in KB. So to get approximately 10MB for the cache file, add the following line:
This will set the new maximum size for the cache file to ~10MB. Note that it is just a maximum; the file will not expand to that size unless it is needed.
In Log File Agent 220.127.116.11 and higher, it will pick up the change automatically. Earlier versions will need to be restarted for the change to take effect.