Making the iCluster event log faster
If you have ever worked with the iCluster event log as a physical file, perhaps to run a custom query over the file, or used DDM to access information from the event log from another system, you may wonder why it takes so long to read through the file.
You are probably using the DMMONHA tool introduced at 5.2 TL1 to keep your event log clean and you should have your system value for Logged message lifetime set to a reasonable value like 7 days, but still the file seems to take forever to read sequentially. Why is that and how can we make it faster?
Well the main physical file behind the event log is called OMEVNTLOPG. It has 3 logicals built on top of it (OMEVNTLGMJ, OMEVNTLGLT and OMEVNTLGMS) keyed by machine name, date and time and msgid respectively. The OMEVNTLOGP file is set for reuse deleted records *YES, but those records will remain until a physical file reorg is done. Issue a DSPFD ICLUSTER/OMEVNTLOGP command, scroll to the bottom and look for the number of records and number of deleted records as below.
If you see more deleted records than current number of records and the file size is very large, it’s time for a reorg. End all replication, ensure there are no locks on the file or its logicals and run a reorg specifying *NONE for the key file. This should make your event log next query or DDM access much faster!