EMS Manual

Collector Event Messages
EMS Manual—426909-005
20-32
524: ZEMS-EVT-LOGTIME-DECREASE
6. The collector issues a LOGTIME-DECREASE event message, with a log
timestamp later than that of event C:
Event C (18:58) ... Event L-D (18:59)
(At least one event message, C, necessarily has a log timestamp that is out of
sequence. In this example, there are two or more such messages: C, L-D, and so
on.)
7. One of the distributors issues a positioning command to the collector, requesting all
event messages with log timestamps of 19:00 and later.
8. The distributor locates, filters, and sends event messages that have suitable
timestamps if the conditions of the filter are met. In this case, messages A and B
are candidates to be sent:
Event A (19:00) ... Event B (19:01)
9. When it checks event message C, the distributor sees a log timestamp earlier than
those requested, so it does not attempt to pass message C.
10. When the distributor checks event message L-D, it sees that this is a LOGTIME-
DECREASE message. Despite the timestamp, 18:59, it passes L-D to its
destination unless its filter has been programmed to reject LOGTIME-DECREASE
event messages.
Effect. The log timestamps are no longer in an ascending pattern. This might cause
distributor positioning errors later.
Recovery. The purpose of this message is to alert system users and management
applications to an out-of-sequence event message or messages. Eventually, each type
of distributor sees the LOGTIME-DECREASE message and sends it to each
destination (unless the filter rejects it). Its meaning depends on that destination.
An operator who sees this message will be concerned with whether the time was
correctly reset, or whether a new resetting is needed. ($Z0 always passes LOGTIME-
DECREASE messages to the console for display or printing.)
An analyst who sees the LOGTIME-DECREASE message in the print-out from an
application will realize that at least one event message—the preceding one—was not
distributed that probably should have been. The analyst can have the distributor issue
a new positioning command, seeking all messages with times early enough so that (in
all likelihood) messages that were skipped are now filtered and distributed. In the
Cause example, seeking log timestamps of 18:57 and later might pick up some
messages earlier than A. In any case, it would pick up message C, 18:58.