Configuration of RegLogMonitorTest

eG agent compares each line (row) in the log file with the format file pattern (containing regular expression) for its exact match. As a result, if the specific line in the log file is matched with the format pattern, then those lines in the log file are considered to be matched lines. Each line in the log file has unique keys based on the Duplicate Detection Key Attributes parameter. If the unique keys are identical with next matched line, then that next matched log lines are considered to be duplicate lines. If the specific line in the log file is not matched with the format pattern, then those lines are considered to be discarded lines. This test helps the administrator to monitor how long the target Regex Log Monitor takes to identify the matched, duplicate and discarded lines by comparing the log file with the format pattern and determine the cause if the Regex matching process gets delayed.

The default parameters associated with this test are as follows:

• The TEST PERIOD/DE-DUPLICATION FREQUENCY list box helps the user to decide how often this test needs to be executed.

• In the HOST text box, the host for which the IP address of the target server to be monitored has to be specified.

• In the PORT text box, specify the port to which the specified host listens. By default, this is 8056

• Specify the full path of the single or wild card log file to be monitored in the LOG SOURCES text box.

  Specific log file name patterns can be also specified. For example, to monitor the latest log files with names containing the string ais, the parameter specification can be /opt/RegexLog/Log Format file/ais_* Here, “*” indicates leading/trailing characters (as the case may be). In this case, the eG agent first enumerates all the log files in the specified path that matches the given pattern, and then picks only the latest log file from the result set for monitoring. Once the test is executed, the administrator can observe the following status of the log files:

  • Changes that occurred in the size and/or timestamp of the log files that were monitored during the last measurement period.
  • New log files that were added since the last measurement period.

  If few lines have been added to a log file that was monitored previously, then the eG agent monitors those additions to that log file, and then proceeds to monitor newer log files (if any). If an older log file has been overwritten, then, the eG agent monitors this log file completely, and then proceeds to monitor the newer log files (if any). The default value for this parameter is unconfigured.

• Specify the full path of the single format file to be monitored in the FORMAT FILE text box. Once the test is executed, the administrator can observe the following status of the format files:

  • Changes that occurred in the size and/or timestamp of the format file that were monitored during the last measurement period.

  The default value for this parameter is unconfigured.

• Specify the case-sensitive comma-separated value of column names (for example-date, time) in the DUP DETECTION KEY ATTRIBUTES text box as already mentioned in the respective log file with “.conf” extension and format file with “fmt” extension. These column names will be used for detecting the duplicated lines in the log file. The default value for this parameter is none.

• This parameter is effective only when the agent is restarted. If you set this flag as NEW ROW, then the agent reads log from new row (line). If you set this flag as LAST PROC ROW,then the agent reads log from the last processed row (line). By default, this flag is set as NEW ROW.

• This parameter is effective only when the values set for DUP DETECTION KEY ATTRIBUTES parameter has some column names other than none as illustrated in the following example:

  Date, msg column names-When several duplicate rows in the log file are detected based on these column names, the first duplicate row will be only applicable. The default value as for this parameter is send first

• Typically, the eG manager generates email alerts only when the state of a specific measurement changes. A state change typically occurs only when the threshold of a measure is violated a configured number of times within a specified time window. While this ensured that the eG manager raised alarms only when the problem was severe enough, in some cases, it may cause one/more problems to go unnoticed, just because they did not result in a state change. For example, take the case of the EventLog test. When this test captures an error event for the very first time, the eG manager will send out a CRITICAL email alert with the details of the error event to configured recipients. Now, the next time the test runs, if a different error event is captured, the eG manager will keep the state of the measure as CRITICAL, but will not send out the details of this error event to the user; thus, the second issue will remain hidden from the user. To make sure that administrators do not miss/overlook critical issues, the eG Enterprise monitoring solution provides the stateless alerting capability. To enable this capability for this test, set the STATELESS ALERTS flag to Yes. This will ensure that email alerts are generated for this test, regardless of whether or not the state of the measures reported by this test changes.

• DD FREQUENCY refers to the frequency with which detailed diagnosis measures are to be generated for this test. The default is 1:1. This indicates that, by default, detailed measures will be generated every time this test runs, and also every time the test detects a problem. You can modify this frequency, if you so desire. Also, if you intend to disable the detailed diagnosis capability for this test, you can do so by specifying none against DD FREQUENCY.

• To make diagnosis more efficient and accurate, eG embeds an optional detailed diagnostic capability. With this capability, the eG agents can be configured to run detailed, more elaborate tests as and when specific problems are detected. To enable the detailed diagnosis capability of this test, by default, for a particular server, choose the On option against DETAILED DIAGNOSIS. To disable the capability, click on the Off option.

  The option to selectively enable/disable the detailed diagnosis capability will be available only if the following conditions are fulfilled:

  • The eG manager license should allow the detailed diagnosis capability.

  • Both the bad and normal frequencies configured for the detailed diagnosis measures should not be 0.

• If multiple components of the same component type are awaiting configuration, then an APPLY TO OTHER COMPONENTS button will appear in this page. Clicking on this button will allow you to apply the configuration to all/selected components of that type.

• Once the necessary values have been provided, clicking on the UPDATE button will register the changes made.

When changing the configuration for specific servers, a “*” beside the text box corresponding to the parameter signifies that these values have to be manually configured by the user. The parameter values that require to be configured will typically be prefixed with a “$” or contain a series of “*”. A value of “none” in the parameter value indicates that the corresponding parameter value can be changed if required.