IBM Enterprise Console Prefiltering NetWare Events, Configuration File, Source, EventId, Severity

Prefiltering NetWare Events

You can improve the performance of the NetWare log file adapter by filtering events, so that only important events are processed. This is called prefiltering and applies only to events logged to the SYS$LOG.ERR file.

To use the prefiltering mechanism, you specify the prefilter statements in the configuration file using a format similar to that used for adapter filters. The prefiltering statements (PreFilter and PreFilterMode) are described in “Configuration File” on page 56.

You must stop and restart the adapter for any changes to take effect.

The following attributes define prefilter statements:

Source

Specifies the source or module that logged the event to the NetWare server log file. You can specify up to 16 sources. Multiple sources must be separated by commas. Examples include SERVER, DS, TIMESYNC, and UPS.

EventId

Specifies the message number assigned by NetWare. You can specify up to 16 message numbers. Message numbers must be separated by commas. EventId is unique for each source.

Severity

Specifies the NetWare-defined severity of the event. You can specify up to 16 severities. Multiple severities must be separated by commas.

Locus Specifies the NetWare-defined locus. You can specify up to 16 loci. Multiple loci must be separated by commas.

Class Specifies the NetWare-defined class. You can specify up to 16 classes.

Multiple classes must be separated by commas.

The following are examples of prefiltering statements:

PreFilter:Source=SERVER;EventId=10,20,30;

PreFilter:Source=DS; Severity=11;Class=5;

Configuration File

The configuration file defines the behavior of the NetWare log file adapter. This file can contain the common keywords listed in “Configuration File” on page 9, as well as the following adapter-specific keywords:

LogSources

Specifies the ASCII log files to poll for messages. The complete path to each file must be specified, and file names must be separated by commas; no spaces or other separators can be used. A log file source need not exist when the adapter is started; it is polled when it is created.

If a file is truncated while the adapter is active, the adapter automatically sets its internal pointer to the new end of the file and continues processing all new messages that are written after the file was truncated. If during the polling interval the file is overwritten, removed, or recreated with more lines than the previous poll, only the number of lines greater than the

56IBM Tivoli Enterprise Console: Adapters Guide