|
Configuration of PepAppLogTest
This test periodically searches the APPSRV.LOG file for specific patterns of error/general information messages and reports the count and nature of such messages, so as to enable administrators to troubleshoot better and to easily obtain configuration details.
The default parameters associated with this test are:
The ALERTFILE text box allows the user to enter full path of APPSRV.LOG files, which are monitored by this test for errors and configuration information. Typically, these log files will be available in the <PSHome>\appserv\<domain>\LOGS directory and will be named in the following format: APPSRV_<mmdd>.log, where <mmdd> refers to the month and date of creation of the log file. In the LOGS directory therefore, you will find multiple APPSRV.log files, one for every day of the month. To enable the test to monitor a specific APPSRV.LOG file, you need to provide the full path to that log file against ALERTFILE. For instance, if <PSHome> (on Windows) is C:\ps, the name of the PeopleSoft domain is psdomain, and the log file you want to monitor was created on the 16th of April, your ALERTFILE specification will be: C:\ps\appserv\psdomain\LOGS\APPSRV_0416.log. Multiple log files can also be monitored as a comma-separated list. For instance, your ALERTFILE specification can be: C:\ps\appserv\psdomain\LOGS\APPSRV_0416.log,C:\ps\appserv\psdomain\LOGS\APPSRV_0420.log. Specific log file name patterns can also be specified. For example, to monitor all the log files created in the months of March and April (i.e., in the 3rd and 4th months), the parameter specification can be, : C:\ps\appserv\psdomain\LOGS\APPSRV_03*.log, C:\ps\appserv\psdomain\LOGS\APPSRV_04*.log. Here, ‘*’ indicates leading/trailing characters (as the case may be).
Your ALERTFILE specification can also be of the following format: Name@logfilepath_or_pattern. Here, Name represents the display name of the path being configured. For instance, to monitor all APPSRV log files that were created in the months of March and April, your specification can be: Marchlogs@ C:\ps\appserv\psdomain\LOGS\APPSRV_03*.log,Aprillogs@C:\ps\appserv\psdomain\LOGS\APPSRV_04*.log. In this case, the display names ‘Marchlogs’ and ‘Aprillogs’ will alone be displayed as descriptors of this test.
Every time this test is executed, the eG agent verifies the following:
Whether any changes have occurred in the size and/or timestamp of the log files that were monitored during the last measurement period; Whether any new log files (that match the ALERTFILE specification) have been newly added since the last measurement period;
If a few lines have been added to a log file that was monitored previously, then the eG agent monitors the additions to that log file, and then proceeds to monitor newer log files (if any). If an older log file has been overwritten, then, the eG agent monitors this log file completely, and then proceeds to monitor the newer log files (if any).
The specific patterns of alerts to be monitored are entered on the SEARCHPATTERN text box. The pattern should be in the following format: <PatternName>:<Pattern>, where <PatternName> is the pattern name that will be displayed in the monitor interface and <Pattern> is an expression of the form - expr or expr or expr or expr, etc. A leading ‘*’ signifies any number of leading characters, while a trailing ‘*’ signifies any number of trailing characters.
For example, say you specify ServerProcess:PSAPPSRV.7948* in the SEARCHPATTERN text box. This indicates that “ServerProcess” is the pattern name to be displayed in the monitor interface. “PSAPPSRV.7948*“ indicates that the test will monitor only those lines in the alert log which begin with the phrase PSAPPSRV.7948. Similarly, if your pattern specification reads: lpAction:*null, then it means that the pattern name is “lpAction” and that the test will monitor those lines in the alert log which end with the term “null”.
A single pattern may also be of the form e1+e2, where + signifies an OR condition. That is, the <PatternName> is matched if either e1 is true or e2 is true.
Multiple search patterns can be specified as a comma-separated list. For example: ServerProcess:PSAPPSRV.7948*,lpAction:*null
If the ALERTFILE specification is of the format Name@logfilepatterns, then the descriptor for this test in the eG monitor interface will be of the format: Name:PatternName. On the other hand, if the ALERTFILE specification consists only of a comma-separated list of log files/patterns, then the descriptors will be of the format: LogFile/Pattern:PatternName.
If you want all the messages in a log file to be monitored, then your specification would be: <PatternName>:*.
Specify two numbers in the format x:y in the LINES box. This means that when a line in the alert file matches a particular pattern, then x lines before the matched line and y lines after the matched line will be reported in the detail diagnosis output (in addition to the matched line). The default value here is 0:0. Multiple entries can be provided as a comma-separated list.
If you give 1:1 as the value for LINES, then this value will be applied to all the patterns specified in the SEARCHPATTERN field. If you give 0:0,1:1 as the value for LINES and if the corresponding value in the SEARCHPATTERN field is like ServerProcess:PSAPPSRV.7948*,lpAction:*null, then:
0:0 will be applied to ServerProcess:PSAPPSRV.7948* pattern
1:1 will be applied to lpAction:*null pattern
By default, the UNIQUEMATCH parameter is set to FALSE, indicating that, by default, the test checks every line in the log file for the existence of each of the configured SEARCHPATTERNS. By setting this parameter to TRUE, you can instruct the test to ignore a line and move to the next as soon as a match for one of the configured patterns is found in that line. For example, assume that ServerProcess:*PSAPPSRV.7948*,lpAction:*null*is the SEARCHPATTERN that has been configured. If UNIQUEMATCH is set to FALSE, then the test will read every line in the log file completely to check for the existence of messages embedding the strings ‘PSAPPSRV.7948’ and ‘null’. If both the patterns are detected in the same line, then the number of matches will be incremented by 2. On the other hand, if UNIQUEMATCH is set to TRUE, then the test will read a line only until a match for one of the configured patterns is found and not both. This means that even if the strings ‘PSAPPSRV.7948’ and ‘null’ follow one another in the same line, the test will consider only the first match and not the next. The match count in this case will therefore be incremented by only 1.
The ROTATINGFILE flag governs the display of descriptors for this test in the eG monitoring console.
If this flag is set to true, then the descriptors of this test will be displayed in the following format: Directory_containing_monitored_file:<SearchPattern>. For instance, if the ALERTFILE parameter is set to C:\ps\appserv\psdomain\LOGS\APPSRV_0415.log, and ROTATINGFILE is set to true, then, your descriptor will be of the following format: C:\ps\appserv\psdomain\LOGS:<SearchPattern>. On the other hand, if the ROTATINGFILE flag had been set to false, then the descriptors will be of the following format: <FileName>:<SearchPattern> - i.e., APPSRV_0415.LOG:<SearchPattern> in the case of the example above.
The CASESENSITIVE flag is set to No by default. This indicates that the test functions in a ‘case-insensitive’ manner by default. This implies that, by default, the test ignores the case of your ALERTFILE and SEARCHPATTERN specifications. If this flag is set to Yes on the other hand, then the test will function in a ‘case-insensitive’ manner. In this case therefore, for the test to work, even the case of your ALERTFILE and SEARCHPATTERN specifications should match with the actuals.
The ROLLOVERFILE flag, by default, is set to false. Set this flag to true if you want the test to support the ‘roll over’ capability (if any) of the specified ALERTFILE. A roll over typically occurs when the timestamp of a file changes or when the log file size crosses a pre-determined threshold. When a log file rolls over, the errors/warnings that pre-exist in that file will be automatically copied to a new file, and all errors/warnings that are captured subsequently will be logged in the original/old file. In such a scenario, since the ROLLOVERFILE flag is set to false by default, the test by default scans only the original/old file for new log entries and ignores the new file. On the other hand, if the flag is set to true, then the test will scan both old and the rolled-over file for new entries.
If you want this test to support the ‘roll over’ capability described above, the following conditions need to be fulfilled:
The ALERTFILE parameter has to be configured only with the name and/or path of one/more alert files. File patterns should not be specified in the ALERTFILE text box. The roll over file name should be of the format: “<ALERTFILE>.”, and this file must be in the same directory as the ALERTFILE.
The OVERWRITTENFILE flag is set to false by default. Set this flag to true if log files do not ‘roll over’ in your environment, but get overwritten instead. In such environments typically, new messages that are captured will be written into the log file that pre-exists and will replace the original contents of that log file; unlike when ‘roll over’ is enabled, no new log files are created for new entries in this case. If the OVERWRITTENFILE flag is set to true, then the test will scan the new entries in the log file for matching patterns. However, if the flag is set to false, then the test will ignore the new entries.
The ENCODEFORMAT, by default, is set to none, indicating that no encoding format applies by default. However, if the test has to use a specific encoding format for reading from the specified ALERTFILE, then you will have to provide a valid encoding format here. Where multiple log files are being monitored, you will have to provide a comma-separated list of encoding formats - one each for every log file monitored - e.g., UTF-8, UTF-16. Make sure that your encoding format specification follows the same sequence as your ALERTFILE specification. In other words, the first encoding format should apply to the first alert file, and so on.
Note:
If your ALERTFILE specification consists of file patterns that include wildcard characters (eg., C:\ps\appserv\psdomain\LOGS\APPSRV_03*.log, C:\ps\appserv\psdomain\LOGS\APPSRV_04*.log(, then such configurations will only be supported in the ANSI format, and not the UTF format.
The USEUTF8 flag, by default, is set to No, implying that the test does not use the UTF-8 format to read from the log files configured for monitoring. However, if the test has to use only the UTF-8 format for reading from all the log files configured for monitoring in your ALERTFILE specification, then set this flag to Yes.
The USEUTF16 flag, by default, is set to No, implying that the test does not use the UTF-16 format to read from the log files configured for monitoring. However, if the test has to use only the UTF-16 format for reading from all the log files configured for monitoring in your ALERTFILE specification, then set this flag to Yes.
Note:
If your ALERTFILE specification consists of file patterns that include wildcard characters (eg., C:\ps\appserv\psdomain\LOGS\APPSRV_03*.log, C:\ps\appserv\psdomain\LOGS\APPSRV_04*.log), then such configurations will only be supported in the ANSI format, and not any of the UTF (UTF-8 or UTF-16) formats.
The DD FREQUENCY flag refers to the frequency with which detailed diagnosis measures are to be generated for this test. The default is 1:1. This indicates that, by default, detailed measures will be generated every time this test runs, and also every time the test detects a problem. You can modify this frequency, if you so desire. Also, if you intend to disable the detailed diagnosis capability for this test, you can do so by specifying none against DD FREQUENCY.
To make diagnosis more efficient and accurate, the eG Enterprise suite embeds an optional detailed diagnostic capability. With this capability, the eG agents can be configured to run detailed, more elaborate tests as and when specific problems are detected. To enable the DETAILED DIAGNOSIS capability of this test for a particular server, choose the On option. To disable the capability, click on the Off option. The option to selectively enable/disable the detailed diagnosis capability will be available only if the following conditions are fulfilled:
- The eG manager license should allow the detailed diagnosis capability
- Both the normal and abnormal frequencies configured for the detailed diagnosis measures should not be 0.
When changing the configuration for specific servers, a “*” beside the text box corresponding to the parameter signifies that these values have to be manually configured by the user. The parameter values that require to be configured will typically be prefixed with a “$” or contain a series of “*”. A value of "none" in the parameter value indicates that the corresponding parameter value can be changed if required.
|