IZ26746: HIGH CPU FOR EVENT LOG PROCESSING

APAR status

• Closed as program error.

Error description

• The event log processing is being enabled for all the event
  logs found on the system.  This is causing high CPU for event
  logs that have high event traffic and no situation is started
  to monitor these logs.  The agent should not enabled the event
  log monitor unless a situation is started that requires the log
  to be monitored.
  
  Detailed Recreation Procedure: Start any situation that monitors
  one log and then all logs will be enabled as can be seen in the
  trace log.
  
  Related Files and Output: None.
  

Local fix

Problem summary

• Situations created to monitor the Windows event logs may cause a
  high CPU condition, because the situation does not define which
  Windows event log to monitor. When a situation does not define
  which Windows event log to monitor, then all the Windows event
  logs must be monitored for events for situation evaluation. Moni
  toring of all the event logs causes a high CPU condition
  because of the high number of events that must be processed for
  all the events logs. Currently, two situations
  NT_Invalid_Logon_Attempt and NT_Service_Error, are shipped with
  the Monitoring Agent for Windows OS and are enabled at start
  up. Both these situations can cause a high CPU condition because
  they do not specify which Windows event log to monitor. To
  correct this problem, the Windows event monitoring process is
  modified to only monitor the Windows event log that is specified
  in the situation. Therefore, it is recommended that any event
  log situation, including the two situations shipped with the Mon
  itoring Agent for Windows OS should specify which Windows event
  log to monitor.
  

Problem conclusion

• This APAR has been fixed and delivered in a limited availability
  fix 6.2.0.1-TIV-ITM_WIN-LA0002. This maintenance delivery
  vehicle is a limited availability patch and therefore is in a
  "hidden directory." Level 2 Support can provide down load
  instructions to you. Contact level 2 support at:
  
  http://www.ibm.com/software/sysmgmt/products/support/Contact_L2
  Support.html
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  ITM AGENT WINDO

• Fixed component ID

  5724C040W

Applicable component levels

• R620 PSY

     UP