IBM Support

IBM Tivoli Monitoring OS Agent - Log File Monitoring Feature README

Fix Readme


Abstract

Documentation for IBM Tivoli Monitoring for Linux and Windows OS Agent - Log File Monitoring Feature. This feature is shipped:
Linux OS Agent - as part of Tivoli Monitoring 6.30 FP7 SP9 (and later)
Windows OS Agent - as part of Tivoli Monitoring 6.30 FP7 SP12 (and later)
UNIX OS Agent - as part of TIvoli Monitoring 6.30 FP7 SP13 (and later)

Content

(C) Copyright International Business Machines Corporation 2022. All rights reserved.
Component: IBM(R) Tivoli(R) Monitoring OS Agents, Version 6.3.0 FixPack 7

IBM Tivoli Monitoring OS Agent - Log File Monitoring Feature README

Date:    16 December 2021 (Linux OS Agent)
Updated: 30 April 2022 (Windows OS Agent)
Updated: 04 October 2022 (UNIX OS Agent)
Contents:
1.0 Introduction
2.0 Installation
3.0 Configuration and Format Files
4.0 Quick Start
5.0 Differences from Tivoli Log File Agent
6.0 Differences from 6.30 FP7 OS Agent
6.1 New Parameters in OS agent environment files
7.0 Migration from Tivoli Log File Agent
8.0 Known problems and limitations
9.0 Troubleshooting
10.0 Change History
Appendix A.  New Attributes

1.0 Introduction
================
This feature allows log files to be monitored with the Tivoli Monitoring OS agents. This provides the functionality as provided by the Tivoli Log File Agent (KLO) and now is included as part of the Linux, Windows, and UNIX OS Agents.  This document describes the implementation for the feature as well as differences with the Tivoli Log File Agent.
When the document uses the convention KXX, the XX is meant to be substituted with:
- LZ for Linux OS agent
- NT for Windows OS agent
- UX for UNIX OS Agent
When the document uses the convention kxx, the xx is meant to be substituted with:
- lz for Linux OS Agent
- nt for Windows OS Agent
- ux for UNIX OS Agent
Highlights of the feature include:
  • The OS agents filter the log data which is sent in the form of a log event to    the monitoring server and portal server.
  • Adding or removing log file monitoring configuration for the OS agents. You add log file monitoring configuration for the OS agents so the OS agents can filter log file data. Then, subsequently, you can also remove the log file monitoring configuration from the OS agents, if necessary.
  • Viewing log file monitoring content. You can view the log file monitoring configuration for the OS agents that you deployed to monitor log files.
  • Displaying log file monitoring events. After you configure the OS agent to monitor log files, you can create thresholds to raise alarms on the log file conditions that you want to be  alerted of.
  • Log file monitoring environment variables. You can set environment variables for log file monitoring in the OS agent environment files.
  • Configuration file. OS agents use a configuration file that is read by the agent when it starts. The file contains configuration options and filters. You must create this     configuration file and configure the agent.
  • Format file. OS agents extract information from log messages and then match different log  messages to event classes. A format file serves as a definition file for matching log messages to event classes, which tells the e vent class what to read, what to match, and how to format the data.
  • Monitoring log files on remote systems is not supported.
2.0 Installation
See following Readme files for instructions on upgrading the agent to the version that includes this feature:
  • Linux OS Agent - IBM Tivoli Monitoring 6.30 Fix Pack 7 Service Pack 9 (6.3.0.7-TIV-ITM-SP0009) or later.
  • Windows OS Agent - IBM Tivoli Monitoring 6.30 Fix Pack 7 Service Pack 12 (6.3.0.7-TIV-ITM-SP00012) or later.
  • UNIX OS Agent - IBM Tivoli Monitoring 6.30 Fix Pack 7 Service Pack 13 (6.3.0.7-TIV-ITM-SP00013) or later.
This feature includes new attributes, queries, and workspaces. The IBM Tivoli Monitoring (ITM) servers (e.g. TEPS, hub TEMS, remote TEMS) also need to be updated to the same Service Pack to utilize the new feature.

3.0  Configuration and Format Files
The keywords and format specifications in the .conf and .fmt that are supported with the Tivoli Log File Agent are supported with this feature.  Details can be found in the online documentation:
https://www.ibm.com/support/knowledgecenter/en/SSTFXA_6.3.0.2/com.ibm.itm.doc_6.3/logfile/klo_conffile.htm
Existing .conf and .fmt files used with the Tivoli Log File Agent can be used with this OS Agent feature.

A sample .conf and .fmt file are provided as $CANDLEHOME/samples/regex1.conf and regex1.fmt when the feature is installed.

4.0 Quick Start
Steps to start using the new feature:
Linux OS Agent:
  • Install the Linux OS Agent 6.30 FP7 SP009 (or later) - both agent and application support.  See the 6.3.0.7-TIV-ITM-SP0009.README for instructions on installing the Service Pack.
  • Edit the $CANDLEHOME/config/lz.ini file and update KLZ_FC_LOG to true:
             KLZ_FCP_LOG=true
             KLZ_FCP_LOG_DISCOVERY_DIR=<location of .conf/.fmt files>

            If .conf/.fmt file are located in the default directory
            ($CANDLEHOME/localconfig/lz/log_discovery), then this environment variable
            does not need to be set .
  •  Restart the OS Agent
Windows OS Agent:
  • Install the Windows OS Agent 6.30 FP7 SP0012 (or later) - both agent and application support.  See the 6.3.0.7-TIV-ITM-SP0012.README for instructions on installing the Service Pack.
  • Edit the %CANDLE_HOME%\<TMAITM6 | TMAITM6_x64>\KNTENV file and update KNT_FCP_LOG to true:
             KNT_FCP_LOG=true
             KNT_FCP_LOG_DISCOVERY_DIR=<location of .conf/.fmt files>

            If .conf/.fmt file are located in the default directory
            (%CANDLE_HOME%\localconfig\nt\log_discovery), then this
            environment variable does not need to be set .
  •  Restart the OS Agent
UNIX OS Agent:
  • Install the UNIX OS Agent 6.30 FP7 SP0013 (or later) - both agent and application support.  See the 6.3.0.7-TIV-ITM-SP00013.README for instructions on installing the Service Pack.
  • Edit the $CANDLEHOME/config/ux.ini file and update KUX_FCP_LOG to true:
             KUX_FCP_LOG=true
             KUX_FCP_LOG_DISCOVERY_DIR=<location of .conf/.fmt files>

            If .conf/.fmt file are located in the default directory
            ($CANDLEHOME/localconfig/ux/log_discovery), then this environment variable does not need to be set .
  •  Restart the OS Agent

5.0 Differences from Tivoli Log File Agent
  •  The Tivoli Log File Agent allows multiple instances to be defined.   Each instance can have a set of .conf and .fmt files to monitor different logs.   The log file functionality being added to the OS Agents does not support multiple instances. Within the OS Agent, it provides the ability, like the Log File Agent, to specify a directory that contains multiple .conf and .fmt files to monitor different logs.
  • Tivoli Log file Agent has the ability at configuration time to specify a specific .conf and .fmt file or specify a directory where .conf/.fmt files are located.  The OS Agent supports only the directory option.
  • Several options of the Tivoli Log File Agent can be specified during the configuration of the agent.   These options are specified as environment variables in the OS agent .ini/ENV file:
Log File Agent configuration option             OS Agent Environment Variable       
Configuration file autodiscovery directory   KXX_FCP_LOG_DISCOVERY_DIR          
Send ITM Events                                           KXX_FCP_LOG_SEND_EVENTS           
Send EIF Events to OMNIbus                       KXX_FCP_LOG_SEND_EIF_EVENTS          
Automatically initialize UNIX syslog           KXX_FCP_LOG_INIT_SYSLOG             
Process Priority Class                                    KXX_FCP_LOG_PROCESS_PRIORITY_CLASS
Process maximum CPU percentage              KXX_FCP_LOG_PROCESS_MAX_CPU_PCT   
See Section 6.1 "New Parameters in OS agent environment files" for more details about the environment variables.

6.0 Differences from 6.30 FP7 OS Agent
fcp_daemon Process
When the agent starts, there can be two fcp_daemon processes that start, one for
Scripting and one for Log Monitoring (assuming both are enabled), for example:
  /opt/IBM/ITM/lx8266/lz/bin/fcp_damon LogMonitoring
  /opt/IBM/ITM/lx8266/lz/bin/fcp_damon Scripting
Previously, there was only one fcp_daemon running (for the Scripting feature) and it did not have the "Scripting" as part of the process name, for example:
  /opt/IBM/ITM/lx8266/lz/bin/fcp_daemon
Attribute Groups
Six new attribute groups have been added to the OS Agent for this feature as detailed below.
  FCP Daemon Status (KXXFCPSTA)
  <Linux|Windows|UNIX> Log File Profiles (KXXLFAPFLS)
  Log File Regex Statistics (KXXLOGFRX)
  Log File Status (KXXLOGFST)
  Log File Profile Events (KXXLOGPEVT)
  Profile Performance Object Status (KXXPROPOS)
  See Appendix A "New Attribute" for a list of the new attributes within each group.  
Queries
The following queries have been added to the OS Agent for this feature:
<Linux|Windows|UNIX> OS:
   - FCP Daemon Status
     FCP Daemon Status
   - Log File Regex Statistics
     Log File Regex Statistics
     Log FiLe Regex Top 10 Average
     Log File Regex Top 10 Total
     Log File Regex Never Matches
   - Log File Status
     Log File Status
<Linux|Windows|UNIX> Log File Profiles
   - Log File Profile Events
     Log File Profile Events
   - Profile Performance Object
     Log File Performance Object Status

Workspaces
Two new OS agent navigation items have been added in the TEP console with the following workspaces:
"Log File Status" navigation item contains the following workspaces:
  •  "Monitored Log File Status" table view showing information for each monitored log  file including how many records are processed.
  • "High Average CPU Regular Expressions" bar chart and table view showing the Top 10 regular expressions by average CPU time consumed.
  • "High Total CPU Regular Expressions" bar chart and table view showing the Top 10 regular expressions by total CPU time consumed.
  • "Unmatched Regular Expressions" table view showing detailed information of unmatched regular expressions.
  • "All Regular Expression Statistics" table view showing statistics for all  the regular expressions.
"<Linux|Windows|UNIX> Log File Profile" navigation item contains the following workspaces:
  • "Logfile Events" table view showing all the logfile events across subnodes.
  • "Data Collection Status" table showing the status for each logfile subnode.
Situation
A new situation, named <Linux|Windows|UNIX>_Log_File_Config_Error is defined which monitors if the status of the log file is not active.  This is defined for the Linux or UNIX Log File Profiles.  
To load the situation on a Windows system, on MTEMS, select:

Tivoli Enterprise Monitoring Server -> Install Product Support (Linux/UNIX) or MTEMS Advanced --> Add TEMS application support (Windows) can be used to load in the kxx_upg.sql (or kxx.sql) which contains the new situation definition.
The new situation definition:
   Formula:  *IF *VALUE kxx_pro_Performance_Object_Status.Object_Status *EQ INACTIVE
   Severity: Warning
   Count = 2
   ATOM= KXXPROPOS.ATTRGRP
History Collection
The new attribute groups are available for historical data collection.
kxx.ref File
There is a file used to communicate between the agent and the fcp_daemon.  Previously, with the Scripting Feature the file was named kxx.ref.   With this feature there will be two files
   Scripting Feature:  kxx_Scripting.ref
   Log File Monitoring Feature: kxx_LogMonitoring.ref
 
The Scripting Feature kxx_Scripting.ref file is dynamically created and APAR IJ02490 allows the location of the file to be customized.   The kxx_LogMonitoring.ref file is shipped as part of the agent and and the APAR does not apply to the file.
 
6.1 New Parameters in OS agent environment files
It is possible to customize the feature setting the following parameters in the OS agent environment file:
  - $CANDLEHOME/config/lz.ini file for the Linux OS agent
  - $CANDLEHOME/config/ux.ini file for the UNIX OS agent
  - %CANDLE_HOME%\TMAITM6_x64\KNTENV for Windows 64-bit OS agent
  -  %CANDLE_HOME%\TMAITM6\KNTENV for Windows 32-bit OS agent
  • KXX_FCP_LOG=<true or false>
  The environment variable needs to be set to "true" for the feature to be enabled. The administrator can enable/disable the feature by setting the environment variable to true or false.
  Example:   KLZ_FCP_LOG=true
  • KXX_FCP_LOG_DISCOVERY_DIR=<location of .conf/.fmt files>
  The location for .conf and .fmt files defining which logs to monitor.  The default location is $CANDLEHOME/localconfig/<product code>/log_discovery.
Other parameters can be defined in the agent environment files based on specific needs:
  • KXX_FCP_LOG_INTERVAL=<n> (default 60 sec)
This variable is used as the interval in seconds for the OS Agent to check with the fcp_daemon for new log file subnodes and error messages. The minimum value is 30 seconds, the maximum value is 300 seconds. Invalid values are be reset to the default.
  • KXX_FCP_LOG_SEND_EVENTS=<true or false>  (default is true)
Send event data to a monitoring server.
  • KXX_FCP_LOG_SEND_EIF_EVENTS=<true or false>  (default is true)
Send event data to one or more EIF receivers (e.g. Tivoli Netcool/OMNIbus ObjectServers)
  • KXX_FCP_LOG_INIT_SYSLOG=<Yes, NO, USE_CONF_FILE_VALUE>
If this option is set to Yes on UNIX and Linux systems, the agent automatically configures the syslog facility to write a standard set of events to a pipe that the agent monitors. By enabling this setting, you can monitor syslog events without maintaining and rolling-over log files. If set to USE_CONF_FILE_VALUE, the agent checks the configuration (.conf) file for the setting (AutoInitSyslog). If not set in the configuration file, it is the same as being set to No. This setting is ignored on Microsoft Windows. The default value is USE_CONF_FILE_VALUE.
  • KXX_FCP_LOG_PROCESS_PRIORITY_CLASS=<A,B,C,D,E,F,"USE_CONF_FILE_VALUE">
This setting is the operating system scheduler priority for the process. A is lowest, C is the operating system default, and F is the highest priority. The setting is one of the following values: A, B, C, D, E, F, "USE_CONF_FILE_VALUE". The default setting is USE_CONF_FILE_VALUE. This setting is associated with the CPU throttling feature.
  • KXX_FCP_LOG_PROCESS_MAX_CPU_PCT=<n> (default 100 seconds)
This setting is the maximum allowable percentage of all system CPU that the agent can use over a 1-minute interval. Valid values are from 5 - 100. This setting is associated with the CPU throttling feature. If you specify a value less than 5, the minimum value of 5 is used.
  • KXX_FCP_USER=<user> (default OS agent user)
Defines the user used to spawn fcp_deamon process if different from OS agent process user; all the log file monitoring is done by this user. Note that the user owner of the OS agent must have correct permission to spawn the fcp_daemon process.
  • KXX_FCP_MAX_DAEMON_RESTARTS=<n> (default 4)
The OS agent watches the fcp_daemon: if an abnormal exit of process occurs, the OS agent restarts it. This is done for the KXX_FCP_MAX_DAEMON_RESTARTS (times at a day). The value 0 must be used to avoid the restart; if -1 is set, the OS agent retries to restart fcp_daemon forever. The restart counter is reset at OS agent restart.

The following Agent Builder (CDP) variables can also be used to control the behavior of the fcp_daemon:
  • CDP_MAXIMUM_ROW_COUNT_FOR_CPCI_DATA_RESPONSES=<n> (default 1000)
Global value added for performance reasons to limit the maximum number of output rows returned by the scripts. Additional rows after this limit are ignored. Allowed values are positive integer. Invalid values mean no limit.
  • The fcp_daemon also supports the other environment variables used to control Agent Builder agents. For a complete list see the official Agent Builder documentation here:
http://publib.boulder.ibm.com/infocenter/tivihelp/v61r1/topic/com.ibm.itm.doc_6.3/agentbuilder63_user.pdf

7.0 Migration from Tivoli Log File Agent
  • Enable the feature
Ensure the KXX_FCP_LOG=true is specified in the lz.ini file.
Ensure the .conf/.fmt files are located in $CANDLEHOME/localconfig/<pc>/log_discovery (default location) or the environment variable KXX_FCP_LOG_DISCOVERY_DIR needs to exist and point to the directory where the .fmt and .conf files are located.
  • Situations
Existing situations for Tiovli Log File Profile need to be re-created using the OS Agent Log FiLe Profiles attribute group. The attribute names have remained consistent.  For example a Tivoli Log File Agent situation that checks for a message = abc, would change from:
*IF *VALUE KLO_LOGFILEPROFILEEVENTS.msg *EQ 'abc'
to
*IF *VALUE Kxx_LogfileProfileEvents.msg *EQ 'abc'
  • Historical Collections
Historical data can be collected under the OS Agent.   Historical data previously collected under the Tivoli Log File Agent is not be merged automatically into the OS Agent.
  • Coexistence
The Tivoli Log File Agent can continue to be installed and run on the same system as the OS Agent running the new Log File feature.   Note if the OS Agent and the Tivoli Log File Agent are both monitoring the same log file, the log file messages are be processed twice (once from each agent) therefore causing duplicate events to be processed (by TEMS, TEPS, EIF receivers).  It is recommended to only do this for limited timeframes when testing.

8.0 Known problems and limitations
The log file feature does not provide full Native Language Support; some issues may be found using Nationalized characters in .conf/.fmt files or log messages.
  • The new workspaces, attributes, queries are provided in English.
  • Remote Log File monitoring is not supported.

9.0 Troubleshooting
Standard KBB_RAS1 variable applies to the OS agent and to the fcp_daemon processes.
To trace the operations logged by the OS agent core threads of the feature:
(UNIT:factory ALL)
To trace logmonitoring queries from the ITM server and events sent to the server, add the entries:
Linux OS Agent:
(UNIT:klz37 ALL) (UNIT:klz38 ALL) (UNIT:klz39 ALL) (UNIT:klz40 ALL) (UNIT:klz41 ALL)
  klz37 - FCP Daemon Status (KLZFCPSTA)
  klz38 - Linux Log File Profiles (KLZLFAPFLS)
  klz39 - Log File Regex Statistics (KLZLOGFRX)
  klz40 - Log File Status (KLZLOGFST)
  klz41 - Log File Profile Events (KLZLOGPEVT)
  klz42 - Profile Performance Object Status (KLZPROPOS)
Windows OS Agent:
(UNIT:klz87 ALL) (UNIT:klz88 ALL) (UNIT:klz89 ALL) (UNIT:klz90 ALL) (UNIT:klz91 ALL)
  klz87 - FCP Daemon Status (KLZFCPSTA)
  klz88 - Linux Log File Profiles (KLZLFAPFLS)
  klz89 - Log File Regex Statistics (KLZLOGFRX)
  klz90 - Log File Status (KLZLOGFST)
  klz91 - Log File Profile Events (KLZLOGPEVT)
  klz92 - Profile Performance Object Status (KLZPROPOS)
UNIX OS Agent:
(UNIT:kux51 ALL) (UNIT:kux52 ALL) (UNIT:kux53 ALL) (UNIT:kux54 ALL) (UNIT:kux55 ALL)
  klz51 - FCP Daemon Status (KLZFCPSTA)
  klz52 - Linux Log File Profiles (KLZLFAPFLS)
  klz53 - Log File Regex Statistics (KLZLOGFRX)
  klz54 - Log File Status (KLZLOGFST)
  klz55 - Log File Profile Events (KLZLOGPEVT)
  klz56 - Profile Performance Object Status (KLZPROPOS)
To trace Log File data collection.
(UNIT:logmonitor ALL)
To see the interaction between the OS agent process and the fcp_daemon in detail add to both KBB_RAS1 and KLZ_FCP_KBB_RAS1:
(UNIT:cps_socket ALL) (UNIT:cpci ALL)

10.0 Change History:
2021-12-16 - Published
2022-02-01     -  Clarified remote log file monitoring.
2022-04-30     -  Updated to include Windows OS Agent
2023-07-02     -  Updated definition for KXX_FCP_LOG_INTERVAL
Appendix A.  New Attributes
Six new attribute groups have been added to the OS Agent for this feature as detailed below.
FCP Daemon Status (KXXFCPSTA)
<Linux|Windows|UNIX> Log File Profiles (KXXLFAPFLS)
Log File Regex Statistics (KXXLOGFRX)
Log File Status (KXXLOGFST)
Log File Profile Events (KXXLOGPEVT)
Profile Performance Object Status (KXXPROPOS)

FCP Daemon Status Attribute Group
Factory provider daemon status
This data set contains the following attributes:
Feature Type - The feature implemented by the Factory Provider This attribute is a key attribute.
Status Code - The factory provider status The type is integer (32-bit numeric property) with enumerated values.
System Name - The managed system name of the agent.
Timestamp - The local time at the agent when the data was collected.

<Linux|Windows|UNIX> Log File Profiles Attribute Group
This atribute group contains the following attributes:
Error Code - The error code that is associated with the query.
Object Status - The status of the performance object.
Subnode Affinity - The affinity for the subnode agent.
Subnode Config File - The path to the discovered configuration file that caused this subnode to be created.
Subnode Description - User supplied description of this subnode.
Subnode MSN - The Managed System Name of the subnode agent.
Subnode Resource Name - The Resource Name of the subnode agent.
Subnode Type - The Node Type of this subnode.
Subnode Version - The Version of the subnode agent.
System Name - The managed system name of the agent.
Timestamp - The local time at the agent when the data was collected.

Log File Regex Statistics Attribute Group
The Log File RegEx Statistics attribute group contains information that shows the statistics of the log file regular expression search expressions.
This data set contains the following attributes:
Attrib Name - The name of the attribute to which this filter is applied.
Average Processor Time - The average number of processor seconds used to process the filter for this attribute.
Filter Count - The number of times the filter has been invoked. Used with the total processor time to compute
Filter Count Matched - The number of times the filter has been invoked and the attribute matched.
Filter Count Unmatched - The number of times the filter has been invoked and the attribute did not match.
Filter Number - The sequence number, starting at zero, of the filter being used for the attribute.
Last Matched Time - The last time the filter was used and the result was matched.
Last Unmatched Time - The last time the filter was used and the result was unmatched.
Max Processor Time - The maximum number of processor seconds used for a single filter processing.
Min Processor Time - The minimum number of processor seconds used for a single filter processing.
RegEx Pattern - The regular expression used for the match. This attribute is a key attribute.
Result Type - The filter type can be INCLUDE or EXCLUDE to accept or reject the attribute if the filter.
System Name - The managed system name of the agent.
Table Name - The name of the log file attribute group. This attribute is a key attribute.
Timestamp - The local time at the agent when the data was collected.
Total Processor Time - The total number of processor seconds used to process the filter for this attribute.

Log File Status Attribute Group
The Log File Status attribute group contains information that reflects the status of log files this agent is
monitoring.
This data set contains the following attributes:
Codepage - The language codepage of the monitored file.
Current File Position - The current position in bytes into the monitored file.
Current File Size - The current size of the monitored file.
File Name - The full path name of the monitored file.
File Status - The current status of this file.
File Type - The type of this file (regular file or pipe).
Last Modification Time - The time when the monitored file was last written to. Not applicable to pipes.
Logkey - The name of the log in which the matching record was found.
Num Records Matched - The number of processed records from this log which matched one of the specified patterns.
Num Records Not Matched  - The number of processed records from this log which did not match any of the specified patterns.
Num Records Processed - The number of records processed from this log since agent start.
RegEx Pattern - The regular expression pattern (if any) that caused this file to be monitored.
Remote Host - The remote host name where the monitored file resides.
Subnode Resource Name - The Resource Name of the subnode agent.
System Name - The managed system name of the agent.
Table Name - The name of the table in which this log is being monitored.
Timestamp - The local time at the agent when the data was collected.

Log File Profile Events Attribute Group
The attribute group contains events matching configured formats in monitored log files.
This attribute group contains the following attributes:
Agent System Name - The managed system name of the agent host system.
Subnode Affinity - The affinity of this subnode.
Subnode Config File - The path to the discovered configuration file that caused this subnode to be created.
Subnode Descriptiong - User supplied description of this subnode, specified via the SubnodeDescription key in the config file.
Subnode MSN - The Managed System Name of this subnode.
Subnode Resource Name - The resource name of this subnode.
Subnode Type - The node type of this subnode.
Subnode Version - The version of this subnode. The type is string.
System Name - The managed system name of the agent.
Timestamp - The local time at the agent when the data was collected.

Log File Profile Events Attribute Group
Events matching configured formats in monitored log files.
This data set contains the following attributes:
Agent System Name - The managed system name of the agent host system.
Class - The Class name of the log file event, as defined in the configured format (.fmt) file.
CustomInteger1 - A user-defined slot with integral type from the EIF event.
CustomInteger2 - A user-defined slot with integral type from the EIF event.
CustomInteger3 - A user-defined slot with integral type from the EIF event.
CustomSlot10 - User-defined slot from the EIF event.
CustomSlot1 - User-defined slot from the EIF event.
CustomSlot2 - User-defined slot from the EIF event.
CustomSlot3 - User-defined slot from the EIF event.
CustomSlot4 - User-defined slot from the EIF event.
CustomSlot5 - User-defined slot from the EIF event.
CustomSlot6 - User-defined slot from the EIF event.
CustomSlot7 - User-defined slot from the EIF event.
CustomSlot8 - User-defined slot from the EIF event.
CustomSlot9 - User-defined slot from the EIF event.
EventId - An event ID per subnode and log file name The type is integer (64-bit gauge).
EIFEvent - The contents of the log file event in EIF format.
Event Type - A flag indicating whether the current event is a flood control summary event.
LogKey - The name of the log in which the matching record was found.
Logname - The name of the log in which the matching record was found.
msg - The contents of the msg slot from the EIF event.
System Name -  The managed system name of the agent.
Occurrence Count - The number of times this event occurred over the current flood control summary interval.
RemoteHost - The remote host on which the event originated if using ssh/remote.
Timestamp - The local time at the agent when the data was collected.

Profile Performance Object Status Attribute Group
The Performance Object Status attribute group contains information that reflects the status of other attribute groups so
you can see the status of all of the performance objects that make up this application all at once.
This data set contains the following attributes:
Average Collection Duration - The average duration of all data collections of this group in seconds.
Cache Hit Percent - The percentage of external data requests for this group that were satisfied from the cache.
Cache Hits - The number of times an external data request for this group was satisfied from the cache.
Cache Misses - The number of times an external data request for this group was not available in the cache.
Error Code - The error code that is associated with the query.
Intervals Skipped - The number of times a background data collection for this group was skipped.
Last Collection Duration - The duration of the most recently completed data collection of this group in seconds.
Last Collection Finished - The most recent time a data collection of this group finished.
Last Collection Start - The most recent time a data collection of this group started.
Number of Collections - The number of times this group has been collected since agent start.
Object Name - The name of the performance object.
Object Status - The status of the performance object.
Object Type - The type of the performance object.
Query Name - The name of the attribute group.
Refresh Interval - The interval at which this group is refreshed in seconds.
System Name - The managed system name of the agent.
Timestamp - The local time at the agent when the data was collected.
================  Document End =================

[{"Type":"MASTER","Line of Business":{"code":"LOB45","label":"Automation"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSTFXA","label":"Tivoli Monitoring"},"ARM Category":[{"code":"a8m500000008bgpAAA","label":"Legacy Categories-\u003EAgents - Generic Category"}],"ARM Case Number":"","Platform":[{"code":"PF002","label":"AIX"},{"code":"PF016","label":"Linux"},{"code":"PF027","label":"Solaris"},{"code":"PF033","label":"Windows"}],"Version":"6.3.0"}]

Document Information

Modified date:
03 July 2023

UID

ibm16510182

Page Feedback