PATROL Agent configuration variables
The following table lists the PATROL KM for Log Management variable settings. All local instance configuration variables are located in /PMG/CONFIG/instanceName. Remote instance configuration variables are located in /REMOTE/HOSTS/ HostName /PMG/.
The variables that are marked as Global in the Global/Instance level column are applicable to all the instances of that file type. The variables that are marked as Instance in the Global/Instance level column are applicable only for the current instance.
Configuration variables for PATROL for Log Management
Variable name | Required? | Description | Type | Global /Instance level |
---|---|---|---|---|
appendLogEntryLinesToCustomEvent | n | Appends the number of lines configured in the Number of lines in log entry field to the custom event message in the TrueSight console.
| Boolean | Instance |
actAlertEvent | n | Log file monitoring blackout indicator. Valid values are:
| Boolean | Instance |
actAlertEventMessage | n | Specify a custom event message. This variable is specific to the default setting for a search criterion. | Text | Instance |
actAlertEventOrigin | n | Specify a custom event origin. This variable is specific to the default setting for a search criterion. | Text | Instance |
actAlertEventTime | n | If the log file is not modified in the last specified minutes, an event is generated and the LOGStatus parameter goes into an alarm state. This variable is required when the value of the actAlertEvent variable is set to | Integer | Instance |
actAtomSize | n | Number of lines in matching log message | Integer | Instance |
actContainEnv | n | Indicates whether the monitored file contains environment variables (format: %ENV_VAR%)
| Boolean | Instance |
actDelInstInMin | n | The time (in minutes) after which an XML instance should be deleted once the closing root-tag is found. | Integer | Instance |
actDur | n | Duration (in seconds) for timed log file scans, based on a 24-hour clock Valid values are 0-86399. The value is calculated with the following formula: Hours*3600+Minutes*60+Seconds For example, a value of 10800 - a 3-hour scan duration. Note If you modify a LOG application instance created using version 2.4.20 or earlier of the product that does not have a scheduled log scan, and convert it to the current format of the scheduled log scanning, this variable gets deleted. | Integer | Instance |
actDurAsEndTime | n | Enables you to set the specified duration to be considered as the End time while scheduling file monitoring | Boolean | Instance |
actFileBegin | y | Specify the log file read position indicator.
| Boolean | Instance |
actFileFilter | n | Specify a filter program. This variable is required when the actFileType variable is set to This filter program must exist and be executable by PATROL Agent user (on UNIX) when the KM reads the configuration instance. | Instance | |
actFilePermissionChange | n | If the pconfig variable /PMG/CONFIG/actFilePermissionChange contains the value '1', the parameter is set to alarm when the permissions on the monitored file change. | Integer | Instance |
actFileSizeExceeds | n | If the pconfig variable /PMG/CONFIG/actFileSizeExceeds contains the value '1', the parameter is set to alarm when the file size of the monitored file exceeds the value specified in the pconfig variable /PMG/CONFIG/actfileSizeThreshold. | Integer | Instance |
actfileSizeThreshold | n | The threshold file size of the monitored file at which the parameter goes into alarm is stored in the pconfig variable /PMG/CONFIG/actfileSizeThreshold. | Integer | Instance |
actFileTimestampChange | n | If you set the pconfig variable /PMG/CONFIG/actFileTimestampChange to a value of parameter is set to alarm when the time stamp of the monitored file changes. | Integer | Instance |
actFileTreatment | y | Specify the log file treatment indicator. This variable is required when the actFileType variable is set to
See actName. | Boolean | Instance |
actFileType | y |
| Integer | Instance |
actIgnoreCase | n | Enables you to make pattern searches that are not case sensitive. To enable this variable, you must add the /PMG/CONFIG/actIgnoreCase variable to the pconfig file and set a value of Valid values are:
This variable is global and applicable to all the LOGMON instances. | Boolean | Global |
actInitialReadEOF | n | Determines the position of the file scan when you restart the PATROL Agent or if a new file matches the file path. You can define the value of the actInitialReadEOF variable in the following ways:
Valid values are:
If you do not define the value of the /PMG/CONFIG/instanceName/actInitialReadEOF pconfig variable, the default value is 1, and the KM scans the file from the end of the file. The default value for this configuration variable was 0 until BMC PATROL for Log Management version 2.7.10 (includes). Since v2.7.10.01 and later the default value has been changed to 1. | Integer | Instance, Global |
actLabel | y | User-entered label for this monitor instance | Text | Instance |
actLogicalName | y | If the instance is a static instance and the logical name is provided through the GUI, the logical name is stored in the pconfig variable /PMG/CONFIG/instanceName/actLogicalName. The LOGMON instance name displays the specified logical name. | Text | Instance |
actMaxRecordSize | n | Enables you to limit or expand the amount of kilobytes of data between the start delimiter and the end delimiter. This variable has a default value of 8 (in KB). If the KM does not find an end delimiter before 8096 bytes or before it reads 8K of data, it ignores the start delimiter and looks for another start delimiter. | Integer | Instance |
actMaxReturnedRecordSize | n | Limits the amount of text from the log file that you specify in an event for multiline record By default, its value is 8 (KB). The value of the actMaxReturnedRecordSize variable should always be less or equal to actMaxRecordSize. | Integer | Instance |
actName | y | Name of the file name of the log file, FIFO, and so on, to be monitored The file name can include wildcard characters. | Text | Instance |
actNameArguments | n | Arguments to be sent to the script in case of script monitoring. | Text | Instance |
actNoMatch | n | Indicates whether or not match has been found.
| Boolean | Instance |
actNullifyString | n | Add a regular expression to nullify the alarm condition. | Text | Instance |
actPriority | y | Specify the monitoring priority.
| Integer | Instance |
actRegexType | y | The used regex style for looking for the search strings
| Text | Instance |
actResetCount | n | Specify the time interval, in seconds, in between two consecutive schedules. After a schedule begins, the next schedule begins after the number of seconds specified in this variable. The default value set for this variable is 86400 seconds (24 hours). Thus, after a schedule begins, the next schedule starts after 24 hours (24*60*60 seconds). Ensure that the value set in the actResetCount variable is greater than the scheduled duration; otherwise the variable is set to the default value of 86400 seconds. Note If you modify a LOG application instance created using version 2.4.20 or earlier of the product that does not have a scheduled log scan, and convert it to the current format of the scheduled log scanning, this variable gets deleted. | Integer | Instance |
actScanAlert | y | Blackout override enable. Valid values are:
| Boolean | Instance |
actScanAlertCount | n | Match count per log file scan to override blackout. | Integer | Instance |
actScanCount | n | Blackout timer in minutes | Integer | Instance |
actSchdlList | y | Enables you to hold the scheduled list while scheduling file scanning | Text | Instance |
actSearchList | y | Stores the entire configuration information of an XML instance For more information, see Using the /PMG/CONFIG/ /actSearchList pconfig variable. | Text | Instance |
actSizeAction | n | Size recovery action indicator.
| Integer | Instance |
actSizeAttend | n | Size recovery action indicator.
| Boolean | Instance |
actSizeLimit | n | Log file size threshold for size recovery actions. Expressed in bytes. Value of 0 disables size recovery action. | Integer | Instance |
actStart | n | Start time for timed log file scans, based on a 24-hour clock Valid values are 0-86399. The value is calculated with the following formula:Hours*3600+Minutes*60+Seconds. For example, a value of 0 - a start time of 00:00:01. Note: If you modify a LOG application instance created using version 2.4.2 or earlier of the product that does not have a scheduled log scan, and convert it to the current format of the scheduled log scanning, this variable gets deleted. | Integer | Instance |
actStateEvent1 | y | Specify the state associated with actStateEventCount1. Valid values are:
The LOGErrorLvl parameter is set to this value when the threshold for a string match is reached. This variable is specific to the default setting for a search criterion. | Integer | Instance |
actStateEvent2 | n | Specify the state associated with actStateEventCount2. Valid values are as follows:
The LOGErrorLvl parameter is set to this value when the threshold for a string match is reached. This variable is specific to the default setting for a search criterion. | Integer | Instance |
actStateEventCount1 | y | Specify the number of monitoring matches per scan before the state change. This variable is only checked if match count is less than actStateEventCount2. This variable is specific to the default setting for a search criterion. | Integer | Instance |
actStateEventCount2 | n | Specify the number of monitoring matches per scan before the state change. This variable is specific to the default setting for a search criterion. See actStateEventCount1. | Integer | Instance |
actStateReturnOK | n | Return to OK indicator.
| Boolean | Instance |
actTouch | y | Log configuration change indicator.
| Boolean | Instance |
actXmlValidity | Enables you to control the values for the LOGStatus parameter Valid values are:
A value of 7 for the LOGStatus parameter refers to an invalid XML file. | Integer | Instance | |
customEvtMatchCount | n | If set to 1, only one event is generated per search criterion independent of the number of matches found. The generated event contains the total number of matches found and the last matched text for the search criterion. The value is stored in /PMG/CONFIG/customEvtMatchCount. | Integer | Global |
delPmgreaderAfterMin | n | Enables you to set the time in minutes that BMC PATROL KM for Log Management waits before deleteing the pmgreader binary from a remote host if you delete all of the instances that you had configured for it. The default value is 10. The value is stored in /REMOTE/HOSTS/HostName/PMG/delPmgreaderAfterMin. | Integer | Global |
dispFullName | n | Displays full names of the filesystem instances. You can display the full name of a filesytem instances by setting the /PMG/CONFIG/dispFullName=1 If you set the /PMG/CONFIG/dispFullName=0 The default value is 0. | Integer | Global |
fileScanTimeLimit | n | Limits the amount of time that the KM spends scanning files You need to manually add the /PMG/CONFIG/fileScanTimeLimit variable. You can set its value as This is a global variable so the time limit set in this variable is split between all of the LOGMON instances. The time allocated for each LOGMON instance is fileScanTimeLimit divided by the total number of LOGMON instances. If the variable is set to a value other than 1, the KM does not limit the time it takes to scan files. If the fileScanTimeLimit variable is set to 1, the total scan time limit is 2 minutes. The KM derives this from the default polling cycle, which is 2 minutes. Therefore, if the total number of LOGMON instances is 4, each instance has a scan time limit of 30 seconds. This polling time is added after the polling cycle starts at 2 minutes. Thus, the maximum time for data collection is 4 minutes. If the fileScanTimeLimit variable is set to anything other than 1, the KM works normally. If the KM is monitoring a large file, and fileScanTimeLimit is set to 1, the KM continues scanning in multiple polling cycles, and the LogStatus parameter is set to a value of 2. If the KM is monitoring a normal size file and completes scanning within the limit, the LogStatus parameter is set to a value of 1. | Integer | Global |
fileSizeGrowthLimit | n | Holds the value of the file size growth limit in kilobytes. If the KM determines that the difference between the old file size and the new file size is greater than the value in the fileSizeGrowthLimit variable, it does not perform scanning. This feature is applicable only for text files. You can add the /PMG/CONFIG/fileSizeGrowthLimit variable to stop scanning of text files when scalability limits have been reached. Set the value of the variable by using The pconfig variable is added globally and is applicable to all the LOGMON instances. If the file size growth is more than the value of the fileSizeGrowthLimit variable, the following actions occur:
| Integer | Global |
ignoreScriptRunError | n | This variable is used for ignoring the script return code in case of script monitoring. So, this can resolve a situation of missing/unknown alert when the script executes properly but it is returning a non-zero code.
| Boolean | Instance |
InstOnFileNotExist | n | Allows an instance to get created on file that does not exist You must add the /PMG/CONFIG/InstOnFileNotExist manually, and set it to a value of 1 . | Boolean | Global |
numOldInstances | n | Controls the number of old instances to be monitored when the File Disposition option in the Add File for Label: instanceName dialog box is set to Latest. The value is stored in the pconfig variable /PMG/CONFIG/numOldInstances. The default value for numOldInstances is 1. Specifying a null string for the Number of Old Instancescauses the KM to delete this variable and revert to the default of 1. If the File Disposition option in the Add File for Label: instanceName dialog box is set to All, the KM ignores the numOldInstances variable. | Integer | Global |
onLatestUsePermanentInst | n | Monitors the latest file with a single permanent Log file instance.
| Boolean | Global |
originNameInEM | n | Controls the format of the origin name in the Event Manager. PNn is a suffix used with the LOGMON instance. (For example, if the name of a LOGMON instance is Test, you see TestPN0 and TestPN1 in the Event Manager.)
From version 2.7.00 of PATROL KM for Log Management onwards, you can configure the originNameInEM variable at the KM level and the instance level to disable the use of a PNn suffix. Instead, the origin name displays the file name of the latest version of the file being monitored. | Boolean | Global |
replaceAnnotationSpecialChars | n | Replaces the special characters (Comma ( , ), double quotation marks ( " ), and single quotation marks ( , )) in the custom event message with tags instead of deleting them from the message.
| Boolean | Global |
searchIdentifierLabel | y | Describes the label for a search criterion that you define. Each time you define a search criterion, this variable is created with the same name as that of the search identifier. This variable is a collection of fields and is created under the /PMG/CONFIG/instanceName/actPatterns pconfig branch. | Text | Instance |
suppressSpaceInMsg | n | Enables you to suppress multiple consecutive spaces in a custom event message. You need to add this variable manually under the /PMG/CONFIG branch. You can assign one of the following values:
| Boolean | Global |
suspendAll | n | Suspends all the instances configured under PATROL KM for Log Management
If you set the /PMG/CONFIG/suspendAll variable to a value of the KM reads from the end of the file. When using the KM interface, the suspendAll variable and thePMGSuspend flag file take precedence over the Suspend KM event generation for a specified time period option. | Boolean | Global |
sendSingleEvent | n | Generates only a single event instead of two events for exceeding a defined threshold. You can generate a single event by setting the /PMG/CONFIG/sendSingleEvent=1 If you set the /PMG/CONFIG/sendSingleEvent=0 The default value value is 0. | Integer | Global |
updateOnConfigChange | n | Enables the KM to read the log file from the last read point in the previous scan when the configuration of the monitored log file changes. The value is stored in the pconfig variable /PMG/CONFIG/updateOnConfigChange. Valid values are:
The default behavior of the KM is to destroy and re-create the log file instance and read the log file from the beginning whenever the configuration of the monitored log file changes. If the pconfig variable /PMG/CONFIG/updateOnConfigChange has a value of '1', the instance is not destroyed and the KM reads the file from the last read point in the previous scan. | Integer | Global |
shrunkLogReadPoint | n | Enables you to reduce the size or truncate log files without reading from the beginning each time that the file is reduced.
If the value is 1, then monitored logs are not read until the next scan. If the configuration variable is missing, that is, if you have not added this variable manually, the log file is read from the beginning of the file. Notes: This variable works only when the log file is a text file. It does not work if the file type is binary or script. Whenever the file timestamp is modified, but the file size remains same, the KM starts reading the file from the beginning. | Integer | Global |
LOGMatchStringLimit | n | Limits the amount of data that is sent to the LOGMatchString parameter. By default, 63K is the maximum amount of data sent to the this parameter. Enter any integer > 0 as value for this variable to indicate the character limit for the amount of data sent to the LOGMatchString parameter. Note: The value of this variable must be less than or equal to 63K. | Integer | Global |
fileDelAction | n | Enables you to select what the KM must do when a monitored file is deleted:
| Integer | Global |
Comments
Log in or register to comment.