IBM Support

Troubleshooting Event Losses when testing Tivoli EIF probe with Log File Agent(LFA)

Technical Blog Post


Abstract

Troubleshooting Event Losses when testing Tivoli EIF probe with Log File Agent(LFA)

Body

Description:
1. When load testing large number of events sent from Log File Agent(LFA) to Tivoli EIF probe, the following scenario can be seen on random occurrences from OMNIbus EventList:
   a. Gradual loss of event while some event continues to arrive at the probe successfully.
   b. Active probe stops receiving events although more events were expected.

2. Preparation of events to be sent from LFA to probe involved the following files:
    a. LFA Agent's Log Source File - Contains events to be send.
    b. LFA Agent's Cache File - Queued/Buffered events during sending process.
    
   - LFA Agent's Log Source file is first populated with events.
     Eg: Property name of file can be set in the ".conf" file
         RegexLogSources=\tmp\data\myevent_source.log

   - During sending LFA Agent's "Cache File" contains buffered/queued events to be sent.
     Eg: Property name of file can be set in the ".conf" file
         BufEvtPath=\tmp\cache\myevent_source.cache
        
Problem Observation from LFA Agent's Cache File:
- Logs indicating LFA agent starts to discard/drop events. Results in 1(a) above.
- Followed by a mention of the cache file is corrupted, if it gets worse over time. Results in 1(b) above.

Resolution:
To re-run/re-send data, clean up & re-create files:
a. Remove LFA Agent's Log Source File & LFA Agent's Cache File
b. Re-Create LFA Agent's Log Source File

Additional Notes:
Increasing memory of JVM in machine where LFA is installed helps.

[{"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Product":{"code":"","label":""},"Component":"","Platform":[{"code":"","label":""}],"Version":"","Edition":"","Line of Business":{"code":"","label":""}}]

UID

ibm11082151