04-09-2011 04:38 PM - last edited on 02-18-2015 06:03 PM by Maiko-I
I have a logfile that is read every 2 minutes and may have many matches for a poll cycle. In the event I need to show the matched value plus the text of the log entry. the way I define it causes every entry to be looked as unique and it creates many events for each poll cycle. Is there a way to match only on the field causing 1 event and many duplicates with each duplicate entry containing the "unique" LogTime and LogMessage. Hopefully not confusing. this is the text of the logile policy:
IF Condition (Log file line: <*.System><_><*.SubSystem> F <*.LogTime>- <*.LogMessage>)
P.S. This thread has been moved from OV IT/Administration Forum to Systems Management (OpenView-OP Mgmt) Support and News Forum. - Hp Forum Moderator
05-13-2011 11:54 AM
07-12-2011 03:30 PM
Duplicate message suppression is great for things like CPU or Disk type policies, but what we've seen is that if a log entry has any kind of difference from one entry to the next, it does not get treated as a duplicate message and is a seperate event.
We are also looking for a way to throttle this kind of log spam as some of these lead to emails via fwdemailasmsg.