Event collapsing does not work for General_EventLog knowledge script. (NETIQKB46099)

  • 7746099
  • 02-Feb-2007
  • 02-Jun-2011

Situation

Event collapsing does not work for General_EventLog knowledge script.

Resolution

AppManager is working as designed.  The General_EventLog knowledge script includes incrementation in the short message to differentiate between events.



Cause

Event collapsing uses the event 'short message' to determine whether the current event is identical to the preceding event.

If the Group Factor is greater than one (>1), Appmanager modifies the event "short message" to include the number of events in the batch and a batch number. The batch number increments under the following circumstances:

  • When multiple groups of events exist
  • For every job iteration - even if there is only one batch in that iteration

Due to incrementation, the "short message" is always  different.  Therefore, AppManager doesn't recognize the events as being identical and does not collapse them. 

If the Group Factor equals one (= 1), the number of events is part of the short message and the short message is different only if the number of events returned differs from the number of events in the previous iteration.  In effect, this means that AppManager bypasses Event Collapsing for this knowledge script.

Additional Information

Formerly known as NETIQKB46099