EMS Manual

Configuring EMS
EMS Manual—426909-005
12-17
Logging Integrity
efficiently, but they are logged on only one node (the local node), and they need
not be processed by all the other distributors at the remote node.
On the other hand, a remote management application communicating with a local
consumer distributor must detect and recover from network errors, whereas a
forwarding distributor transmitting event messages to the remote node would
assume that burden. And, if you later decide to switch from a local consumer
distributor to a forwarding distributor, the remote management application would
have to be changed to open a consumer distributor on its own node.

How much operator support is available at each location? If there are operators at
each location, some event messages—such as those reporting action events—
should probably not be forwarded. If there are locations without operator support,
you should have most, if not all, event messages forwarded.
If some of your nodes have limited resources to devote to EMS, arrange the
configuration so that the collectors on the nodes with few resources log their event
messages directly to files on a remote node (without running through a forwarding
distributor). This is particularly effective for systems linked by FOX because of the
efficiency and reliability of the link. For systems linked by other types of
communications lines, forwarding distributors are better, as they transmit event
messages in blocks (for efficiency) and they recover automatically from link
failures. (Because collectors begin logging on the local system when the remote
system becomes unavailable, a collector must be explicitly redirected to the remote
log file when the link is re-established.)
Whatever decisions you make about the type of messages to be forwarded, you
should always analyze the requirements carefully and to use effective (highly
selective) filters, where possible, to reduce network traffic. Also, ensure that the
filters used by your forwarding distributors do not let event messages from a
remote node be forwarded back to that node (directly or indirectly). Running event
messages in circles around your network is not an efficient use of resources.
Logging Integrity
EMS provides reliable event logging. With tasks associated with log switches being
performed when the collector is idle, and with a higher rate of message logging
achieved by setting message blocking, the collector has a greater ability to handle
event bursts and minimize the possibility of losing events.
Still, a few exceptional conditions can result in lost event messages. You can avoid or
reduce the frequency of these conditions by certain configuration decisions, usually at
the cost of reducing a collector’s peak logging rate or of dedicating additional
resources to the collector.
For a description of how message delivery can continue after logging fails, see
Delivery Integrity
on page 12-19.
A collector can fail to log some event messages under these circumstances: