LogFilter

Similar Questions

• Add LogFilter match string for the subject line of the e-mail notification

  Hello

  On the LogFilter alerts, I add the matching string in the subject line of the e-mail logfilter alert notification. I followed KB 75058 for this requirement. But I'm getting other data also with the match string. Please find the attached screenshot. The chain is marked in yellow. I don't need data which is marke red din. Can you let me know if a setting can be done in the script that retrieves the hitstring so that only the histstring appear

  FMS: 5.6.4

  Kind regards

  Roshan.

  Additional accessories:

  • HitString.txt.zip
  • Logfile.PNG

  Hi Roshan

  We do something similar.  We have configured a Message appropriate for each matching string user:

  

  Then, in the rule Condition, I created an expression UserError containing the following:

  def controls = checkObservationAlarms (#LogFilter_ErrorVerbose to 1ms #,)

  {the entry->

  If (entry.get ("Severity") == "WARNING") {}

  return 2;

  }

  If (entry.get ("Severity") == 'CRITICAL') {}

  return 3;

  }

  If (entry.get ("Severity") == "FATAL") {}

  return 4;

  }

  return 0;

  },

  {entry, severity-> {switch (severity)}

  case 2:

  Return entry.get ("User_Message");

  case 3:

  return "" + entry.get ("User_Message") + "";

  case 4:

  return "" + entry.get ("User_Message") + "";

  by default:

  Return ' ';

  }}, @foglight_rule_id);

  If (checks.size () > 0) {}

  return checks [0] [1];

  } else {}

  Return ' ';

  }

  By referencing @UserError in the subject line, I get the Message to the appropriate user.

  I also do a similar thing for the severity of error appropriate in my subject line.

  Hope this helps

  Brian

• LogFilter - ignoring the first alarm

  Here's the situation. We have three servers brprlmbpxxx and LogFilter agents deployed on each server. One of the strings match that we monitor is "Communication link failure". Every morning, we get two alerts on each server for a total of six alerts. We were informed by the developers that we can ignore these first six alerts every day. What I'm trying to do is to find a way that we do not have these six alerts but receive alerts later.

  Here is some info on this. These six alerts can come from any time of the day. So, I don't know if there is a way to configure a rule that will ignore the first two "Communication link failure" alerts LogFilter and then draw attention to any warning which follows.

  Hello Raul

  If these alerts are sent at the same time every day, you might have to try a power failure?

  Brian

• Darken a specific string Match (LogFilter)

  I have a string of specific match I need black out for a time determined on a daily basis. We currently have one LogFilter officer set up for that particular log with a match string list that we monitor. There is a single string that I need blackened every morning between 04:00 and 07:45. The only way I think I can do it is if I have LogFilter a second officer and apply only the one corresponding to the string, then I can this particular agent of LogFilter black. Can anyone confirm if it would work? Would I meet problems because we follow the same newspaper on two different officers of LogFilter?

  You can control the same log file with several agents. Each agent will retain its own pointer to the log file of the previous analysis of the new entries in the log file.

• Registry value - appears not all Agents of LogFilter

  I am trying to add a scope to the email alert at the LogFilterAgent level. However, when I search the hostname it happens with 3 agents of LogFilter. As you can see in my screenshot below, we have LogFilter 5 officers. Why all the LogFilters will not be displayed? I try to add the agent that is circled in red.

  

  

  With LogFilter, you can have an agent deployed, but if she never equaled a string, he would have all the data.  Just a guess, but these three are the only ones who have ever matched a string, so data collected?  Just have LogFilter agent running will not provide data in the data model.

  Jeff

• Severity of the error for Agent of LogFilter and rule

  Hello

  When you change the list of messages of LogFilter trap, you get to choose the severity of the error and a Message from the user for the particular match strings:

  

  I already know how to make the message to display in the body of the e-mail message, but how can we get the string the severity of error to be displayed in the subject line?  If I use @foglight_severity_level, it returns 1, which is the level of seriousness for the real LogFilter rule.  If I use @foglight_severity_level_name, this returns fire, which is the name of the level of seriousness for the real LogFilter rule.

  Given the ability to choose the level within the list of messages of Logfilter trap, there must be an easy way to get this as a variable to use in an e-mail subject line?

  Thank you

  Brian

  Hello everyone

  I finally managed to get this working.  I created a new Expression called error using the following code:

  def controls = checkObservationAlarms (#LogFilter_ErrorVerbose to 1ms #,)

  {the entry->

  If (entry.get ("Severity") == "WARNING") {}

  return 2;

  }

  If (entry.get ("Severity") == 'CRITICAL') {}

  return 3;

  }

  If (entry.get ("Severity") == "FATAL") {}

  return 4;

  }

  return 0;

  },

  {entry, severity-> {switch (severity)}

  case 2:

  'WARNING '.

  case 3:

  return "criticism";

  case 4:

  return "Fatal."

  by default:

  Return ' ';

  }}, @foglight_rule_id);

  If (checks.size () > 0) {}

  return checks [0] [1];

  } else {}

  Return ' ';

  }

  .. who I picked up community forums.  I also created an additional call to the UserError Expression that takes the custom error that you provide in the trap of messageliste within the agent that uses the following code:

  def controls = checkObservationAlarms (#LogFilter_ErrorVerbose to 1ms #,)

  {the entry->

  If (entry.get ("Severity") == "WARNING") {}

  return 2;

  }

  If (entry.get ("Severity") == 'CRITICAL') {}

  return 3;

  }

  If (entry.get ("Severity") == "FATAL") {}

  return 4;

  }

  return 0;

  },

  {entry, severity-> {switch (severity)}

  case 2:

  Return entry.get ("User_Message");

  case 3:

  return "" + entry.get ("User_Message") + "";

  case 4:

  return "" + entry.get ("User_Message") + "";

  by default:

  Return ' ';

  }}, @foglight_rule_id);

  If (checks.size () > 0) {}

  return checks [0] [1];

  } else {}

  Return ' ';

  }

  The most attentive of you will notice that case 2 has a different format in the box 4-3 and case in the above.

  Part of the reason for this rule takes so much time programming is that if I made a change to the rule code (for example change WARNING WARNING in the case statement of the first code), Foglight would not record the change and would rather a null value or an empty value.  Weird next workaround often worked: I would like to return to what it was originally, trigger the alarm, change to what it should be, the alarm and continue to do that until the change has been recognized by more.  For the above code, no matter how many times I changed the cases 3 and 4 to resemble the presentation of case 2, I could never make it work

  This behavior has only affected this particular rule; other custom rules that I programmed in the past have been absolutely perfect.

  My matiere2 line becomes:

  @ServerName: @Error: @UserError

  (@ServerName is set elsewhere) which gives a very nice:

  Some.Server.com: caveat: NetWorker backup failure - backup failed

  .. What is exactly what I'm looking for.

  Brian

• Can I add a timestamp in logfilter

  Hi all

  Have two questions I need information:

  1. can I add timestamp 'file' in the path of the logFilter Agent file, so that I can get the logs currently generated in the Management Server?

  2. If so, how can I add the timestamp and monitor the log files that is generated at that time?

  You can monitor a rolling log file by specifying the name of 'base' of the file with the option "churn."

  The LogFilter agent automatically match the base name and begin monitoring of the current version of the file when the log returns to a new name with timestamp.

  For example, Foglight Agent Manager (FglAM) writes a logfile with a base name more a timestamp like a counter like: ' FglAM_2013-01 - 17_094536_001.log.

  You can automatically analyze the current log file by matching the first characters of the name of this file:

  

  Kind regards

  Brian Wheeldon

• LogFilter Condition

  I created a log for a specific host filtering rule. I'd like the alert rule when it detects a specific string. I would add something like this under the scope of the rule

  LogFilter_ErrorVerbose where monitoredHost.name = "xxxx" & occurrences = occurrences return result.values (scope) {it.contains ("xxxXXX")}.value.findAll () .size > threshold

  For alert filter paper when he sees a strong in a log file all you have to do is add this string in the list under the properties of the agent.

  Just leave the original rule as-is, change the properties of this agent logfilter, clone the game list so that you can have a list for this specific agent and change the list of correspondence for the string and the severity level, it represents

  You can view the document for more information

  http://eDOCS.quest.com/Foglight/565/doc/wwhelp/wwhimpl/common/HTML/frameset.htm?href=cartridge/OSCartridge/index.php

  As well as the text of the document next for example http://en.community.dell.com/techcenter/performance-monitoring/foglight-administrators/w/admins-wiki/5646.monitoring-application-availability-using-foglight-utility-agents

  Golan Shem-Tov

• Question about the display of what log file mapped in LogFilter agent

  Hello

  LogFilter agent allows you to have up to 4 different log files (and paths) to match strings in the list.

  Is there a way to make a rule that kicks in when there is a match of logFilter - to have access to what filepath had the match?

  So, for example if I have;

  /path1/server.log

  /path3/server.log

  and if the rule that fires when the logFilter has a match, I would like it to show which of the 2 filepaths contained the game.

  Thank you

  "mark".

  Hi Mark,

  The default LogFilter rule creates an alarm that contains the path to the log file of the execution of the variable of severity level "text".

  This script uses "entry.get("LogName")" to extract the name of the log file, which is displayed in the Message field of alarm and the alarm dialog box as well as the text that triggered the alarm:

  

  Kind regards

  Brian Wheeldon

• LogFilter variable matching channel available?

  Hello

  When you use the Logfilter agent on Linux machines - is it possible to get all line which the regex String matched game on?

  I know that the Message of the user can be passed to a rule in the FMS, I wondered if the whole line is available by the rules to include in a message alert type?

  example - if the match string. * Timeout.*

  and if the line is: javax.xml.ws.WebServiceException: org.jboss.ws.core.WSTimeoutException: timeout after: 60000ms

  This entire line would be available for the rule to include in an email?

  Thank you

  "mark".

  Great!

  Thank you once again.

  iPad would be

• A matching logfilter string can span several consecutive lines in a log file

  Hello

  is it possible to have a matching log filtering string cover several consecutive lines in a log file?

  Unfortunately, we have some error messages in the log files that I need to match that cover several new lines.  You don't know why they did it, but his frustration for us at the end of surveillance.

  So would need to have a matching string that correspond to a portion on the first line and another on lines 1-2 below.

  My guess is that it can not be done, but thought I'd check here first.

  "mark".

  Confirmed.

  LogFilter reads and tests for matches of the mistake of a single line of the log at a time.

  Kind regards

  Brian Wheeldon

• LogFilter appears only not on the Unix host

  Not able to get the officer of filtering the log to display on the dashboard for my unix host agent but it is display for my windows host.

  Hi James,

  Officials appear on the Foglight model when the agent referred to the FMS data and not before. The LogFilter agent must present only data of the FMS when occurs a match of error log file. It is likely that your LogFIlter agent that runs on Windows reported an error to the FMS but your Unix LogFilter agent has not yet. If and when that happens, you can expect the agent to model object to create and appear in the dashboard of the Agents.

  Kind regards

  Brian WHeeldon

• Looking for an example of a rule FMS to the process that matches LogFilter

  Hello

  am looking for an example of a rule that manages different LogFilter matches?

  I installed a handful of filter string matches a logfilter officer and was looking for an example rule that could read the Message string for the user and manage each matching filter separately.

  So, I would have 4 match of different styles in an agent instance filter a log and would manage each game separately.

  The only rule of type existing LogFilter I found on the system had what is stated below in the part of the rule Condition:

  checkObservationAlarms (#LogFilter_ErrorVerbose to 1ms #,)

  {the entry->

  If (entry.get ("Severity") == "WARNING") {}

  return 2;

  }

  If (entry.get ("Severity") == 'CRITICAL') {}

  return 3;

  }

  If (entry.get ("Severity") == "FATAL") {}

  return 4;

  }

  return 0;

  },

  {entry, severity-> {switch (severity)}

  case 2:

  return "" + entry.get ("LogName") + ":" + entry.get ("Error_Message") + ""; ""

  case 3:

  return "" + entry.get ("LogName") + ":" + entry.get ("Error_Message") + ""; ""

  case 4:

  return "" + entry.get ("LogName") + ":" + entry.get ("Error_Message") + ""; ""

  by default:

  Return ' ';

  }}, "542c111ff5feabe3803bccb722386cae") () .size > 0;

  ----

  But I don't know if I need to change it it seems to be some sort of standard boilerplate for this type of rule.

  I need to be able to key off the field to the user Message.  So even if I have 1 rule for each 4 journal of my agent logfilter properties filter models, it's ok.  I just need to understand how to do a test for the rule based on the user Message field values or extends its reach to this particular user Message string.

  I'll post a picture of the logfilter message strings.

  So I would look on the way to have a fair rule match the logfilter agent when the returned string is "ECG_Java_Memory_Error", then I would have another rule for each of the other models in the returned string.

  Looking for an example of a standard type.

  Thank you

  "mark".

  It is the major brand

  David Mendoza

  Foglight Consultant

• Foglight - LogFilter

  All,

  Come play with the tool serveurfiltrage for the first time here.

  Can someone give me some definitions here? I don't see anythingon edocs.

  What does roll saves the average? and recycling of messages? Consecutive messages?

  Thank you

  -Daniel Wilson

  I'll give it a shot:

  ball bearings is an indicator that logs can roll in a new log such as log001, log002, log003, etc.  I remember that the manual of the OS has a good explanation of regular expressions to define the log file names where the bearing can be configured.

  recycling of messages is the number of seconds when alarms assocated with logfilter messages are deleted automatically. Usually, this value has a default value of 3600 seconds. Without this option, logfilter alerts should be disabled manually.

  Consecutive messages - the number of alert messages are created for in a log file. If your agent logfilter is set to 2 and the third consecutive message is detected, an alert will not be generated.

  Special attention to match gravity and strings to the list when you define logfilter match strings - I can explain more

  David Mendoza

  Foglight Consultant

• LogFilter creating alarms, but not email action shooter

  Hello

  I came across a problem of "e-mail action" today as he tried to implement the rule of the Logfilter agent. I copied the outside "LogFilter' box and personalized just rule to change the email address.

  The address that I use is the same I have been receving emails everyday with success on other rules.

  I also see alarms, created by the Logfilter rule, but action will not fire.

  I have fire action on 1 consecutive evaluation with a schedule of "Always". I don't know where is the problem. I tried to create a support package to look at where the e-mail action is a failure, but did not.

  Please can someone help?

  Thank you very much!

  APO - Barro

  This is the condition

  checkObservationAlarms (#LogFilter_ErrorVerbose to 1ms #,)

  {the entry->

  If (entry.get ("Severity") == "WARNING") {}

  return 2;

  }

  If (entry.get ("Severity") == 'CRITICAL') {}

  return 3;

  }

  If (entry.get ("Severity") == "FATAL") {}

  return 4;

  }

  return 0;

  },

  {entry, severity-> {switch (severity)}

  case 2:

  return "" + entry.get ("LogName") + ":" + entry.get ("Error_Message") + ""; ""

  case 3:

  return "" + entry.get ("LogName") + ":" + entry.get ("Error_Message") + ""; ""

  case 4:

  return "" + entry.get ("LogName") + ":" + entry.get ("Error_Message") + ""; ""

  by default:

  Return ' ';

  }}, "542c111ff5feabe3803bccb722386cae") () .size > 0;

  And "text" variable of severity assessment

  createObservationAlarms (#LogFilter_ErrorVerbose to 1ms #,)

  {the entry->

  If (entry.get ("Severity") == "WARNING") {}

  return 2;

  }

  If (entry.get ("Severity") == 'CRITICAL') {}

  return 3;

  }

  If (entry.get ("Severity") == "FATAL") {}

  return 4;

  }

  return 0;

  },

  {entry, severity-> {switch (severity)}

  case 2:

  return "" + entry.get ("LogName") + ":" + entry.get ("Error_Message") + ""; ""

  case 3:

  return "" + entry.get ("LogName") + ":" + entry.get ("Error_Message") + ""; ""

  case 4:

  return "" + entry.get ("LogName") + ":" + entry.get ("Error_Message") + ""; ""

  by default:

  Return ' ';

  }}, "542c111ff5feabe3803bccb722386cae");

  When you have copied the LogFilter rule, have you changed the id of the rule which is in the last line of the State? If you do not change this rule id, the copied rule will not be triggered.