Configuring after installation

Specify the name of the label for the log file that you want to start monitoring.

Select this check box to enter a path defined by an environment variable that is resolved at run time. If you select this check box, environment variables in the binary file path are resolved. Otherwise, the binary file is treated as a pure file name.

Select ALL option if you are monitoring a dynamically named file and you want to monitor all of the files using the dynamic name specified in the File/Pipe Name field, rather than just the latest file.

The KM has three predefined collection intervals which can be set by configuring the Scan Priority field. This field displays the priority level at which you want the instance to be scanned.

The priority-collection interval mapping:

• Normal is associated with the LogMainColl and LogRemoteMainColl collectors. Select this option to scan the file every 2 minutes.
• Medium is associated with the LogMainCollP2 collector. Select this option to scan the file every 10 minutes.
• Low is associated with the LogMainCollP3 collector. Select this option to scan the file every 30 minutes.

If you want to change how often the file is scanned, change the polling time of these collectors. The default scan interval is 2 minutes.

Note: You cannot select a value other than Normal for remote log instances. Attempting to do so will result in an error message.

Setting a custom collection interval:

You can set a none-default value also known as, custom collection interval, for each of the above priority values.

1. Navigate to your Log Management KM policy and select the Polling Intervals tab.
2. Click Add Polling Interval.
   
   1. In the Monitoring solution field, select Log Management.
   2. Select the version.
   3. Select the Monitor Parameter as per your requirements. For more information, refer Scan priority, collection interval, and collection timeout table.

   4. Set the polling interval of the monitor parameter with the custom collection interval.

   5. Save the policy.

Scan priority, collection interval, and collection timeout table

Note: If you are using Log Management KM prior to version 2.7.30, ensure that the predefined data collection interval value does not exceed the collection timeout value.

Select this check box if you want the instance to generate an alarm if the monitored file is not modified periodically. Specify the time in minutes after which you want the KM to alarm if the file is not modified, in the minutes text box.

Select this checkbox iIf the KM goes into an alarm or a warning state because the search string is found and you want the KM state to return to OK if the search string is not found on the next scan.

Specify a filter program.

Select this check box if you want to scan the entire text file on each scan, rather than scanning only the new content.

Note: The text file will only be scanned if the file changes.

Multiline Search

Expand the Remote Monitoring frame to add a remote host for monitoring.

Remote hostname: Specify the hostname for remote monitoring. This field is applicable only for UNIX and Linux platforms. UNIX KM must be installed and the Remote Monitoring policy must be defined.

Search Criteria Settings

Pattern Search Criteria: Click  to configure a Pattern Search Criteria for the configured file. 

Search Criteria Event Handling Configuration: Expand the frame to add a search criteria for handling events.

Specify the minimum number of text search string matches in a polling cycle required to produce a specified state.

To search for a minimum number of text strings across a number of polling cycles, enter values in the x : y format; x represents the minimum number of text string matches, and y represents the total number of polling cycles.

Select the state that you want the KM to exhibit when a threshold is reached.

• • None
  • Ok
  • Warn
  • Alarm

Note: If you want the KM to go into alarm when the search string is found 3 times in the monitored file, then you would set the value of Threshold #1 to 3 and select Alarm from the State list.

Specify the minimum number of text search string matches required to produce a specified state. You can specify a different state and a different number of matches from Threshold #1. Threshold #2 should be higher than Threshold #1. To search for a minimum number of text strings across a number of polling cycles, enter values in the x:y format.

Select the state that you want the KM to exhibit when a threshold is reached.

• • None
  • Ok
  • Warn
  • Alarm

Note: If you want the KM to go into alarm when the search string is found 3 times in the monitored file, then you would set the value of Threshold #1 to 3 and select Alarm from the State list.

Specify the message that you want to be displayed in the events when your search string conditions are satisfied. For more information, see Customizing event messages.

Specify the customized origin for events. If you do not specify the origin, the product uses the instance name as the default origin of events, which is APPCLASS.INSTANCE.textFileName. You can use built-in macros (except the %x[-%y] macro) as the customized origin for events.

Specify the time threshold for which the duplicate events will be ignored. You can also modify the default search criterion settings after you configure the instance.

The KM supports monitoring of PATROL Agent log files with predefined search criteria. To enable this monitoring, select the Monitor PATROL log files check box.

When this option is enabled, the KM creates two monitoring instances, PAgentLog_Alarm and PAgentLog_Warn to monitor the PATROL Agent log files with the predefined search criteria.

• PAgentLog_Alarm - This instance is configured to raise the alarm if one or more of the following strings are detected:

• • “found inconsistencies”
  • “PatrolAgent-W-EINTERNAL: PatrolAgent is running low on memory”
  • “PatrolAgent: "not superuser"
  • “Please check parameter history for corruption“
  • “runqSchedPolicy is now set to 9“
  • “Detected during operation readRec.fseek”
  • PAgentLog_Alarm

• PAgentLog_Warn - This instance is configured to raise a warning if one or more of the following strings are detected:

• • “remaining for PATROL license to expire”
  • “Not authorized connect agent”
  • “Please check parameter history for corruption”
  • “PatrolAgent-E-EFORK: Couldn't fork a new process”

The PAgentLog_Alarm and PAgentLog_Warn monitoring instances have a constant predefined search criteria that cannot be edited.

Select this check box if you want the KM to collect debug information for the pmgreader process in the log file.

The diagnostic output is written to the monitored system in the following location:

• on UNIX: $PATROL_HOME/../pmg/port_ int*/readerLog.txt*
• on Windows:%PATROL_HOME%\port_ int*\readerLog.txt*

where port is the port used by the agent and int is an integer (1, 2, or 3) that corresponds to the LOG KM collector's scan priority.

Note: Selecting this check box enables debug information collection for all supported file types - text, binary, script, XML, and named pipe.

Specify the logical name of the instance that you want to monitor. Maximum 80 characters are supported in this field.

Specify the full path and the filename for the file that you want to monitor.

Note: To monitor log files that have dynamic names, use the * and ?regular expressions to define the file name. For example, if a log file is named backup_date.log, where date changes each day, enter the log file name as backup_*.log.

Regular expressions are not accepted for named pipes. Maximum 900 characters are supported in this field.

Select this check box to enter a path defined by an environment variable that is resolved at run time. If you select this check box, environment variables in the named pipe path are resolved. Otherwise, the named pipe is treated as a pure file name.

The KM has three predefined collection intervals which can be set by configuring the Scan Priority field. This field displays the priority level at which you want the instance to be scanned.

The priority-collection interval mapping:

• Normal is associated with the LogMainColl and LogRemoteMainColl collectors. Select this option to scan the file every 2 minutes.
• Medium is associated with the LogMainCollP2 collector. Select this option to scan the file every 10 minutes.
• Low is associated with the LogMainCollP3 collector. Select this option to scan the file every 30 minutes.

If you want to change how often the file is scanned, change the polling time of these collectors. The default scan interval is 2 minutes.

Note: You cannot select a value other than Normal for remote log instances. Attempting to do so will result in an error message.

Setting a custom collection interval:

You can set a none-default value also known as, custom collection interval, for each of the above priority values.

1. Navigate to your Log Management KM policy and select the Polling Intervals tab.
2. Click Add Polling Interval.
   
   1. In the Monitoring solution field, select Log Management.
   2. Select the version.
   3. Select the Monitor Parameter as per your requirements. For more information, refer Scan priority, collection interval, and collection timeout table.

   4. Set the polling interval of the monitor parameter with the custom collection interval.

   5. Save the policy.

Scan priority, collection interval, and collection timeout table

Note: If you are using Log Management KM prior to version 2.7.30, ensure that the predefined data collection interval value does not exceed the collection timeout value.

Select this check box if you want the instance to generate an alarm if the monitored file is not modified periodically. Specify the time in minutes after which you want the KM to alarm if the file is not modified, in the minutes text box.

Select this checkbox iIf the KM goes into an alarm or a warning state because the search string is found and you want the KM state to return to OK if the search string is not found on the next scan.

Multiline Search

Expand the Multiline Search frame to configure the start and end delimiters.

Expand the Remote Monitoring frame to add a remote host for monitoring.

Remote hostname: Specify the hostname for remote monitoring. This field is applicable only for UNIX and Linux platforms. UNIX KM must be installed and the Remote Monitoring policy must be defined.

Search Criteria Settings

Pattern Search Criteria: Click  to configure a Pattern Search Criteria for the configured file. 

Search Criteria Event Handling Configuration: Expand the frame to add a search criteria for handling events.

Specify the minimum number of text search string matches in a polling cycle required to produce a specified state.

To search for a minimum number of text strings across a number of polling cycles, enter values in the x : y format; x represents the minimum number of text string matches, and y represents the total number of polling cycles.

Select the state that you want the KM to exhibit when a threshold is reached.

• • None
  • Ok
  • Warn
  • Alarm

Note: If you want the KM to go into alarm when the search string is found 3 times in the monitored file, then you would set the value of Threshold #1 to 3 and select Alarm from the State list.

Specify the minimum number of text search string matches required to produce a specified state. You can specify a different state and a different number of matches from Threshold #1. Threshold #2 should be higher than Threshold #1. To search for a minimum number of text strings across a number of polling cycles, enter values in the x:y format.

Select the state that you want the KM to exhibit when a threshold is reached.

• • None
  • Ok
  • Warn
  • Alarm

Note: If you want the KM to go into alarm when the search string is found 3 times in the monitored file, then you would set the value of Threshold #1 to 3 and select Alarm from the State list.

Specify the message that you want to be displayed in the events when your search string conditions are satisfied. For more information, see Customizing event messages.

Specify the customized origin for events. If you do not specify the origin, the product uses the instance name as the default origin of events, which is APPCLASS.INSTANCE.textFileName. You can use built-in macros (except the %x[-%y] macro) as the customized origin for events.

Specify the time threshold for which the duplicate events will be ignored. You can also modify the default search criterion settings after you configure the instance.

Enter the logical name of the instance that you want to monitor. A maximum of 80 characters are allowed in this field.

Enter the full path and the filename of the script that you want to monitor.

A maximum of 900 characters are supported in this field.

To successfully run and monitor a script file output, ensure that the script can run without any runtime dependency. For example, the script file \temp\cpumonitor.bat can run without any runtime dependency. Therefore, it is monitored by the KM. However, if the script file requires a command to run or has any other runtime dependency, the KM does not monitor it. For example, if the \temp\cputmonitor.py script is executed by running the following command:

python \temp\cputmonitor.py

Such a script output is not monitored by the KM.

Select the check box if the full path contains environment variable and the path defined by the environment variable is resolved at run time.

Id=id1 
031605: Error: Disc Full 
Id=;MatchedLines 
/hd001 mounted as /opt 
SUMMARY:id1=1;

Specify the string to nullify the alarm for the dual search feature. You can configure dual search for an instance so that the KM goes into the alarm state when any of the search criteria is found in the monitored file and nullifies the alarm when the nullify string is found in the monitored file.

You must specify the first string in the Search String 1 > String text box of the Pattern search criteria section and the nullify string in this text box. For the nullified customized events, the default custom event message is used (as provided in the Custom Event Message text box in the Pattern search criteria section).

If you specify Alarm up in the String1 text box and Alarm down in this text box, the KM goes into an alarm state when Alarm up is found in the monitored file and the alarm is nullified when Alarm down is found in the monitored file.

Select the regex type that you want to use to prepare the search criteria.

Note: The ECMAScript option is not supported on the HP-UX platform.

In the String text box, enter the search string in one of the following formats:

• A combination of XML elements and values that you want to find in the monitored file. For configuring XML search strings, see Rules for entering XML search strings.
• Search pattern(s) - Each search pattern must be a valid regular expression. Enclose each pattern in parentheses ({}).

Select this check box to custom-define the settings for each search criterion.

You can custom-define a search criterion with the settings that are different from the default settings.

Enter the customized origin for events. If you do not specify the origin, the KM uses the instance name as the default origin of events, which is APPCLASS.INSTANCE.textFileName.

You can use built-in macros (except the %x[-%y] macro) as the customized origin for events.

Specify the time threshold for which duplicate events are ignored.

Note: You can also modify the default search criterion settings after you configure the instance.

Enter the customized origin for events. If you do not specify the origin, the KM uses the instance name as the default origin of events, which is APPCLASS.INSTANCE.textFileName.

You can use built-in macros (except the %x[-%y] macro) as the customized origin for events.

Specify the time threshold for which duplicate events are ignored.

Note: You can also modify the default search criterion settings after you configure the instance.

Specify the logical name of the instance that you want to monitor. Maximum 80 characters are supported in this field.

Specify the full path and the filename for the file that you want to monitor.

Note: To monitor log files that have dynamic names, use the * and ?regular expressions to define the file name. For example, if a log file is named backup_date.log, where date changes each day, enter the log file name as backup_*.log.

Regular expressions are not accepted for named pipes. Maximum 900 characters are supported in this field.

Select this check box to enter a path defined by an environment variable that is resolved at run time. If you select this check box, environment variables in the XML file path are resolved. Otherwise, the XML file is treated as a pure file name.

The KM has three predefined collection intervals which can be set by configuring the Scan Priority field. This field displays the priority level at which you want the instance to be scanned.

The priority-collection interval mapping:

• Normal is associated with the LogMainColl and LogRemoteMainColl collectors. Select this option to scan the file every 2 minutes.
• Medium is associated with the LogMainCollP2 collector. Select this option to scan the file every 10 minutes.
• Low is associated with the LogMainCollP3 collector. Select this option to scan the file every 30 minutes.

If you want to change how often the file is scanned, change the polling time of these collectors. The default scan interval is 2 minutes.

Note: You cannot select a value other than Normal for remote log instances. Attempting to do so will result in an error message.

Setting a custom collection interval:

You can set a none-default value also known as, custom collection interval, for each of the above priority values.

1. Navigate to your Log Management KM policy and select the Polling Intervals tab.
2. Click Add Polling Interval.
   
   1. In the Monitoring solution field, select Log Management.
   2. Select the version.
   3. Select the Monitor Parameter as per your requirements. For more information, refer Scan priority, collection interval, and collection timeout table.

   4. Set the polling interval of the monitor parameter with the custom collection interval.

   5. Save the policy.

Scan priority, collection interval, and collection timeout table

Note: If you are using Log Management KM prior to version 2.7.30, ensure that the predefined data collection interval value does not exceed the collection timeout value.

Select this check box if you want the instance to generate an alarm if the monitored file is not modified periodically. Specify the time in minutes after which you want the KM to alarm if the file is not modified, in the minutes text box.

Select this checkbox iIf the KM goes into an alarm or a warning state because the search string is found and you want the KM state to return to OK if the search string is not found on the next scan.

Expand the frame to configure the XML settings.

Multiline Search

Expand the Multiline Search frame to configure the start and end delimiters.

Expand the Remote Monitoring frame to add a remote host for monitoring.

Remote hostname: Specify the hostname for remote monitoring. This field is applicable only for UNIX and Linux platforms. UNIX KM must be installed and the Remote Monitoring policy must be defined.

Search Criteria Settings

Pattern Search Criteria: Click  to configure a Pattern Search Criteria for the configured file. 

Search Criteria Event Handling Configuration: Expand the frame to add a search criteria for handling events.

Specify the minimum number of text search string matches in a polling cycle required to produce a specified state.

To search for a minimum number of text strings across a number of polling cycles, enter values in the x : y format; x represents the minimum number of text string matches, and y represents the total number of polling cycles.

Select the state that you want the KM to exhibit when a threshold is reached.

• • None
  • Ok
  • Warn
  • Alarm

Note: If you want the KM to go into alarm when the search string is found 3 times in the monitored file, then you would set the value of Threshold #1 to 3 and select Alarm from the State list.

Specify the minimum number of text search string matches required to produce a specified state. You can specify a different state and a different number of matches from Threshold #1. Threshold #2 should be higher than Threshold #1. To search for a minimum number of text strings across a number of polling cycles, enter values in the x:y format.

Select the state that you want the KM to exhibit when a threshold is reached.

• • None
  • Ok
  • Warn
  • Alarm

Note: If you want the KM to go into alarm when the search string is found 3 times in the monitored file, then you would set the value of Threshold #1 to 3 and select Alarm from the State list.

Specify the message that you want to be displayed in the events when your search string conditions are satisfied. For more information, see Customizing event messages.

Specify the customized origin for events. If you do not specify the origin, the product uses the instance name as the default origin of events, which is APPCLASS.INSTANCE.textFileName. You can use built-in macros (except the %x[-%y] macro) as the customized origin for events.

Specify the time threshold for which the duplicate events will be ignored. You can also modify the default search criterion settings after you configure the instance.