Tivoli Log File Agent version 18.104.22.168 went GA on July 6, 2012. New features include the following:
- Subnodes-- it is now possible to have multiple log monitoring "profiles", where a set of configuration files (one .conf, and one .fmt) constitutes a profile, within a single agent instance. This allows you to limit patterns to only be searched in the log files where they might actually occur, by separating them into different configurations, without having to create multiple instances. So a single agent can now do all your log monitoring on a system, keeping everything separate, while not bumping up against port limits or requiring multiple processes.
- CPU usage limits-- there is now a configuration parameter that lets you specify a maximum percentage of the CPU that the agent will use. It calculates how much processor it is using, and if it sees the level going above what is set, it backs off for a while. The measurements are averaged over one minute, so on a shorter time scale, you may see it going above the limit set, but it smooths out over a minute.
- Multiple EIF channels-- it is now possible to configure more than one EIF receiver (typically the OMNIbus EIF probe) in a .conf file, and the agent will send all events to all receivers simultaneously on background threads. This allows for continued receipt of events without delays in the event that one receiver goes down. Using the existing EIF failover function still works, but potentially suffers operating system-induced delays when a receiver goes down. Some systems don't report that absence of the receiver for a long time.
- Regular Expression file specification-- the LogSources conf file statement only allows filename patterns to be given as wildcards (* and ?). In 6232 a new RegexLogSources conf file statement is added, which allows full regular expressions to be used instead. It also allows a regular expression to be used in one directory of the path, rather than only in the filename part, as with LogSources. So you can use, for example:
to pick up logs from all instances of an application.
- SMA support-- ITM supports a smaller footprint install image, the "system monitor agent" format. Version 22.214.171.124 supports installing into this environment. Note that it requires that the SMA version of the OS agent already be installed. The LFA SMA installer does not provide the ITM libraries and so forth, so it can't be installed by itself. The OS agent is a prereq. The SMA install has other limitations, such as no interactive configuration or remote deploy support. But with the OS agent pre-installed, this provides a smaller footprint version of the agent.