We have an journal-probe for iSeries (IBM i / AS400) that checks for all kinds of diffrent audit-changes on the machine. This could be ALOT. Over 1000 messages/alarams every day.
The problem is that this makes the history log very hard to use sometimes. If I would like to do a quick query for "last hour", 100 of the alarms will be from the audit-journal. And going back for a week or so, it's almost impossible if you don't specify your query.
The messages from the the journal probe are not important, we just send the directly to a external SYSLOG.
So my question is: Can I these alarms to not be part of the history log, somehow?