NetIQ AppManager 6.x
NetIQ AppManager 7.x
Tivoli Enterprise Connector
In the Tivoli event console (TEC) multiple events are being collapsed into one event if they are from the same knowledge script.
Events are being forwarded by the connector properly, event collapsing is occuring on the Tivoli side.
Disable the dup_detect setting in the rule.
the following information from the Tivoli "Rules Builder's Guide" (version 3.7 and version 3.8) explains how to alter this setting:
Defines the criteria for determining whether two events are the same; that is, they are duplicates of each other.
Note: Setting the dup_detect facet only provides a definition. You must create rules to test for duplicate events and specify the actions to take when they're detected by rule processing. Two events are considered duplicates if they have the same values for all attributes defined with the dup_detect facet set to yes and if they are of the same event class. For example, assume the following event class definition:
Person ISA EVENT
The following events are considered duplicates because the attribute values of their respective name and address attributes are the same (assuming both events are of the same event class):
<"Joe","Lafayette","XYZ Widgets","Ham Radio">
By default, dup_detect is no.
It is not recommended that users modify the baroc file.
The Tivoli Enterprise Connector for AppManager does not collapse events forwarded to Tivoli. Every event received by the Management server will be forwarded to Tivoli and AppManager does no pre-processing of the events or de-duplication of events. AppManager does not create events with duplicate EventIDs. Each event within AppManager is unique. Every event a KS creates will be given a unique EventID, unless events are collapsed by AM in which case there is no event to be fowarded to TEC from AM. The connector will only forward unique events.