IBM Support

What value should be used for Source of PreFilter of Configuration file (.conf) of LFA ?

Question & Answer


Question

What value should be used for Source of PreFilter of Configuration file (.conf) of LFA ?

Answer

You should use the Provider Name for Source of PreFilter.
In the Windows Event Viewer, if the value of the Provider Name started with "Microsoft-Windows-" in the Details tab of an event, "Microsoft-Windows-" are omitted and the rest of the string is displayed in the "Source:" of the General tab of the event. However, LFA gets the value of Source which includes "Microsoft-Windows-" from Windows API, therefore, the Provider Name should be used for Source of PreFilter.
For example, if you saw "DNS-Server-Service" in the "Source:" of the General tab and "Microsoft-Windows-DNS-Server-Service" in the Provider Name in the Details tab in an event, you should use "Microsoft-Windows-DNS-Server-Service" instead of "DNS-Server-Service".

Internal Use Only

This is come from Case# TS002419812.

[{"Business Unit":{"code":"BU004","label":"Hybrid Cloud"},"Product":{"code":"SSZ8F3","label":"IBM Tivoli Monitoring V6"},"Component":"Log File Agent (LFA)","Platform":[{"code":"PF033","label":"Windows"}],"Version":"All Versions","Edition":""}]

Document Information

Modified date:
30 June 2019

UID

ibm10957917