Logfile Monitoring Delays?

Monitoring logfiles using a policy with hundreds and hundreds of conditions can cause HPOM's logfile encapsulator (opcle) to run into problems.

I have seen delays in message receive time on the HPOM manager in numerous HPOM installations, sometimes hours behind the original logfile alert time, which is obviously unacceptable in production monitoring environments.

HP support couldn't offer much help, but a few key principles can help reduce this problem and hopefully eradicate it completely.

1. Try and ensure the logfile being monitored is named specifically, or if using a command to generate a list of logfiles, try and make sure this list is small
2. Try and keep the number of policy conditions to a minimum where possible
3. Try and ensure as much suppression is placed at the top of the logfile monitoring policy to ensure opcle matches and drops unncessary text as soon as possible (thereby freeing it up to parse additional lines)
4. Consider changing the environment variable which allows opcle to read multiple lines at a time - for example OPC_LE_MAX_LINES_READ
5. Review the logfile polling period

Hope this helps.
Dave