Events forwarded to Tivoli are collapsed by Tivoli. (NETIQKB15877)

Each event message when viewed in the TEC and the AppManager connector log file has a unique event ID.

In the Tivoli event console (TEC) multiple events are being collapsed into one event if they are from the same knowledge script.

Events are being forwarded by the connector properly, event collapsing is occuring on the Tivoli side.

Disable the dup_detect setting in the rule.

the following information from the Tivoli "Rules Builder's Guide" (version 3.7 and version 3.8) explains how to alter this setting:

----------------------

dup_detect

Defines the criteria for determining whether two events are the same; that is, they are duplicates of each other.

Note: Setting the dup_detect facet only provides a definition. You must create rules to test for duplicate events and specify the actions to take when they're detected by rule processing. Two events are considered duplicates if they have the same values for all attributes defined with the dup_detect facet set to yes and if they are of the same event class. For example, assume the following event class definition:

TEC_CLASS:
Person ISA EVENT
DEFINES {
name:STRING,dup_detect=yes;
city:STRING,dup_detect=yes;
employer:STRING;
hobbies:STRING;
};

The following events are considered duplicates because the attribute values of their respective name and address attributes are the same (assuming both events are of the same event class):

<"Joe","Lafayette","ABC Widgets","Computers">

<"Joe","Lafayette","XYZ Widgets","Ham Radio">

By default, dup_detect is no.

-------------------------------

A rule in Tivoli was created to enable it's own duplicate detection mechanism, which was interfering with the event presentation on the Tivoli Enterprise Connector.

Formerly known as NETIQKB15877

It is not recommended that users modify the baroc file.

The Tivoli Enterprise Connector for AppManager does not collapse events forwarded to Tivoli. Every event received by the Management server will be forwarded to Tivoli and AppManager does no pre-processing of the events or de-duplication of events. AppManager does not create events with duplicate EventIDs. Each event within AppManager is unique. Every event a KS creates will be given a unique EventID, unless events are collapsed by AM in which case there is no event to be fowarded to TEC from AM. The connector will only forward unique events.