IBM Enterprise Console, Manual

Page: 68 / 194

Prefiltering NetWare Events
You can improve the performance of the NetWare log file adapter by filtering
events, so that only important events are processed. This is called prefiltering and
applies only to events logged to the SYS$LOG.ERR file.
To use the prefiltering mechanism, you specify the prefilter statements in the
configuration file using a format similar to that used for adapter filters. The
prefiltering statements (PreFilter and PreFilterMode) are described in
“Configuration File” on page 56.
You must stop and restart the adapter for any changes to take effect.
The following attributes define prefilter statements:
Source
Specifies the source or module that logged the event to the NetWare server
log file. You can specify up to 16 sources. Multiple sources must be
separated by commas. Examples include SERVER, DS, TIMESYNC, and
UPS.
EventId
Specifies the message number assigned by NetWare. You can specify up to
16 message numbers. Message numbers must be separated by commas.
EventId
is unique for each source.
Severity
Specifies the NetWare-defined severity of the event. You can specify up to
16 severities. Multiple severities must be separated by commas.
Locus Specifies the NetWare-defined locus. You can specify up to 16 loci. Multiple
loci must be separated by commas.
Class Specifies the NetWare-defined class. You can specify up to 16 classes.
Multiple classes must be separated by commas.
The following are examples of prefiltering statements:
PreFilter:Source=SERVER;EventId=10,20,30;
PreFilter:Source=DS; Severity=11;Class=5;
Configuration File
The configuration file defines the behavior of the NetWare log file adapter. This file
can contain the common keywords listed in “Configuration File” on page 9, as well
as the following adapter-specific keywords:
LogSources
Specifies the ASCII log files to poll for messages. The complete path to
each file must be specified, and file names must be separated by commas;
no spaces or other separators can be used. A log file source need not exist
when the adapter is started; it is polled when it is created.
If a file is truncated while the adapter is active, the adapter automatically
sets its internal pointer to the new end of the file and continues processing
all new messages that are written after the file was truncated. If during the
polling interval the file is overwritten, removed, or recreated with more
lines than the previous poll, only the number of lines greater than the
56
IBM Tivoli Enterprise Console: Adapters Guide