7/2/2007 eG Help
  Agents Administration - Tests
 

Default Parameters for LogMonitorTest

The LogMonitorTest monitors multiple log files for different patterns. This page depicts the default parameters that need to be configured for the LogMonitorTest.

  • The TEST PERIOD list box helps the user to decide how often this test needs to be executed. 

  • In the ALERTFILE text box, specify the path to the log file to be monitored. For eg., /user/john/new_john.log. Multiple log file paths can be provided as a comma-separated list - eg., /user/john/critical_egurkha.log,/tmp/log/major.log.

    Also, instead of a specific log file, the path to the directory containing log files can be provided - eg., /user/logs. This ensures that eG monitors the most recent log files in the specified directory. If while monitoring a log file in a directory a newer log file gets added to that directory, then eG will first finish monitoring the original log file and then start monitoring the new one. Specific log file name patterns can also be specified, so that the log file(s) monitored are restricted to files that match the specified patterns. For example, to monitor the latest log files with names containing the strings 'dblogs' and 'applogs', the parameter specification can be, /tmp/db/*dblogs*,/tmp/app/*applogs*. Here, '*' indicates leading/trailing characters (as the case may be).

    The eG monitor interface will report one set of measurements for every configured path. You can also configure the path in the following format:Name@logfilepath. Here, Name represents the display name of the path being configured. Accordingly, the parameter specification for the 'dblogs' and 'applogs' example discussed above can be: dblogs@/tmp/db/*dblogs*,applogs@/tmp/app/*applogs*. In this case, the display names 'dblogs' and 'applogs' will alone be displayed as descriptors of this test, and not the individual paths.

  • In the SEARCHPATTERN text box, enter the specific patterns of log file entries to be monitored. The pattern should be in the following format:<PatternName>:<Pattern>, where <PatternName> is the pattern name that will be displayed in the monitor interface and <Pattern> is an expression of the form - *expr* or expr or *expr or expr*, etc. A leading '*' signifies any number of leading characters, while a trailing '*' signifies any number of trailing characters.

    For example, say you specify ORA:ORA-* in the SEARCHPATTERN text box. This indicates that "ORA" is the pattern name to be displayed in the monitor interface. "ORA-*" indicates that the test will monitor only those lines in the log file which start with the term "ORA-". Similarly, if your pattern specification reads: offline:*offline, then it means that the pattern name is offline and that the test will monitor those lines in the log which end with the term offline.   A single pattern may also be of the form e1+e2, where + signifies an OR condition. That is, the PatternName is matched if either e1 is true or e2 is true.

    Multiple search patterns can be specified as a comma-separated list. For example: ORA:ORA-*,offline:*offline*,online:*online

  • In the LINES text box, specify two numbers in the format x:y. This means that when a line in the log file matches a particular pattern, then x lines before the matched line and y lines after the matched line will be reported in the detail diagnosis output (in addition to the matched line). The default value here is 0:0. Multiple entries can be provided as a comma-separated list. 

    If you give 1:1 as the value for LINES, then this value will be applied to all the patterns specified in the SEARCHPATTERN field. If you give 0:0,1:1,2:1 as the value for LINES and if the corresponding value in the SEARCHPATTERN filed is like ORA:ORA-*,offline:*offline*,online:*online then:

    0:0 will be applied to ORA:ORA-* pattern

    1:1 will be applied to offline:*offline* pattern

    2:1 will be applied to online:*online pattern

  • Provide a comma-separated list of patterns to be excluded from monitoring in the EXCLUDEPATTERN text box. For example, Pattern1:*critical*, Pattern2:*exception*. By default, this parameter is set to 'none'.

  • By default, the UNIQUEMATCH parameter is set to FALSE, indicating that, by default, the test checks every line in the log file for the existence of each of the configured SEARCHPATTERNS. By setting this parameter to TRUE, you can instruct the test to ignore a line and move to the next as soon as a match for one of the configured patterns is found in that line. For example, assume that Pattern1:*fatal*,Pattern2:*error* is the SEARCHPATTERN that has been configured. If UNIQUEMATCH is set to FALSE, then the test will read every line in the log file completely to check for the existence of messages embedding the strings 'fatal' and 'error'. If both the patterns are detected in the same line, then the number of matches will be incremented by 2. On the other hand, if UNIQUEMATCH is set to TRUE, then the test will read a line only until a match for one of the configured patterns is found and not both. This means that even if the strings 'fatal' and 'error' follow one another in the same line, the test will consider only the first match and not the next. The match count in this case will therefore be incremented by only 1.

  • By default, the ROTATINGFILE parameter is set to FALSE. To instruct the eG system to monitor newer log files also, set this parameter to TRUE. Otherwise, set it to FALSE.

  • Once the necessary values have been provided, clicking on the UPDATE button will register the changes made.

When changing default configurations of tests, the values with "$" indicate variables that will be replaced by the eG system according to the specific server being managed - for instance, $hostName is the host/nickname of the target host, $port is the port number of the server being monitored. E.g., for a server xyz:80, $hostName will be changed automatically by the eG manager to "xyz" and $port will be changed to "80" when configuring a test.