The Plugin mk_errpt.aix (https://github.com/tribe29/checkmk/blob/master/agents/plugins/mk_errpt.aix, mk_logwatch.aix in checkmk <= 1.6) is collecting the AIX Errorlog Events by running the errpt command and save the latest Errorlog Message in $MK_VARDIR/mk_errpt_aix.last_reported.
Our AIX Admins are deleting some of the Errorlog Events from time to time (e.g. by running “/usr/bin/errclear -d S,O 30” which deletes only the operator and software errors). All old Errorlog Errors are send again by mk_errpt.aix when the message which is saved in $MK_VARDIR/mk_errpt_aix.last_reported is also deleted by this command.
It would be great when the collection method for mk_errpt.aix can be changed: the date of the last Errorlog Event should be saved in the $MK_VARDIR/mk_errpt_aix.last_reported, and command errpt should be used with option -s and the date from the VAR-file to get only newer Events than the last Event.