PATROL Agent configuration variables

Appends the number of lines configured in the Number of lines in log entry field to the custom event message in the TrueSight console. 

• 0 - Disabled (Default value)
• 1 - Enabled

Boolean

Log file monitoring blackout indicator. 

Valid values are:

• 0 - blackout disabled
• 1 - blackout enabled

If the log file is not modified in the last specified minutes, an event is generated and the LOGStatus parameter goes into an alarm state.

This variable is required when the value of the actAlertEvent variable is set to 1.

Indicates whether the monitored file contains environment variables (format: %ENV_VAR%) 
Valid values are:

• 0 - no environment variable expansion takes place
• 1 - the monitored file name entered is checked for environment variables. Items enclosed in '%' are expanded in the variable defined at the PATROL 
  start time or replaced with the string MISSING.

Duration (in seconds) for timed log file scans, based on a 24-hour clock Valid values are 0-86399. The value is calculated with the following formula: 

Hours*3600+Minutes*60+Seconds For example, a value of 10800 - a 3-hour scan duration.

Specify the log file read position indicator. 
Valid values are:

• 0 - each file scan starts from the position where the previous scan ended (previous EOF)
• 1 - file is scanned from the beginning each time

Specify a filter program. This variable is required when the actFileType variable is set to 4 (when the file type is a binary).

This filter program must exist and be executable by PATROL Agent user (on UNIX) when the KM reads the configuration instance.

If the pconfig variable /PMG/CONFIG/actFilePermissionChange contains the value '1', the parameter is set to

alarm when the permissions on the monitored file change.

If the pconfig variable /PMG/CONFIG/actFileSizeExceeds contains the value '1', the parameter is set to alarm

when the file size of the monitored file exceeds the value specified in the pconfig variable /PMG/CONFIG/actfileSizeThreshold.

If you set the pconfig variable /PMG/CONFIG/actFileTimestampChange to a value of 1, the

parameter is set to alarm when the time stamp of the monitored file changes.

Specify the log file treatment indicator. This variable is required when the actFileType variable is set to 1 (when the file type is text). 
Valid values are:

• 1 - monitor latest matching file
• 2 - monitor all matching files

See actName.

• Specify the type of monitored log file. Valid values are: 1 - text file
• 2 - command
• 3 - pipe
• 4 - binary file

Enables you to make pattern searches that are not case sensitive. To enable this variable, you must add

the /PMG/CONFIG/actIgnoreCase variable to the pconfig file and set a value of 1. 

Valid values are:

• 1 - ignore case
• 0 or anything other than 1 - case-sensitivity is enforced

This variable is global and applicable to all the LOGMON instances.

If the instance is a static instance and the logical name is provided through the GUI,

the logical name is stored in the pconfig variable /PMG/CONFIG/instanceName/actLogicalName.

The LOGMON instance name displays the specified logical name.

Enables you to limit or expand the amount of kilobytes of data between the start delimiter and the end delimiter.

This variable has a default value of 8 (in KB). If the KM does not find an end delimiter before 8096 bytes or before it reads 8K of data,

it ignores the start delimiter and looks for another start delimiter.

Limits the amount of text from the log file that you specify in an event for multiline record

By default, its value is 8 (KB). The value of the actMaxReturnedRecordSize variable should always be less or equal to actMaxRecordSize.

Indicates whether or not match has been found. 
Valid values are:

• 0 - an event is not generated if no matches are found during the timed scan
• 1 - an event is generated if no matches are found at the end of a timed scan

Specify the monitoring priority. 
Valid values are:

• 1 - normal priority
• 2 - medium priority
• 3 - low priority

The used regex style for looking for the search strings

• ECMAScript – The ECMAScript standard regex style.
• PATROL – The patrol regex style (used in 2.7.30.01 and earlier)

Blackout override enable. Valid values are:

• 0 - override feature disabled
• 1 - override feature enabled

Size recovery action indicator. 
Valid values are:

• 1 - no recovery action
• 2 - clear log file
• 3 - backup and clear log file

Size recovery action indicator. 
Valid values are:

• 1 - run unattended
• 2 - run interactively

Start time for timed log file scans, based on a 24-hour clock Valid values are 0-86399.

The value is calculated with the following formula:Hours*3600+Minutes*60+Seconds.

For example, a value of 0 - a start time of 00:00:01. Note: If you modify a LOG application instance created using version 2.4.2

or earlier of the product that does not have a scheduled log scan, and convert it to the current format of the scheduled log scanning, this variable gets deleted.

Specify the state associated with actStateEventCount1. Valid values are:

• 1 - No Action
• 2 - OK
• 3 - Warn
• 4 - Alarm

The LOGErrorLvl parameter is set to this value when the threshold for a string match is reached.

This variable is specific to the default setting for a search criterion.

Specify the state associated with actStateEventCount2. Valid values are as follows:

• 1 - No Action
• 2 - OK
• 3 - Warn
• 4 - Alarm

The LOGErrorLvl parameter is set to this value when the threshold for a string match is reached.

This variable is specific to the default setting for a search criterion.

Specify the number of monitoring matches per scan before the state change.

This variable is only checked if match count is less than actStateEventCount2. This variable is specific to the default setting for a search criterion.

Specify the number of monitoring matches per scan before the state change.

This variable is specific to the default setting for a search criterion. See actStateEventCount1.

Return to OK indicator. 
Valid values are:

• 0 - KM continues to alert until manually reset
• 1 - set LOGErrorLvl/value to 1 if no matches in next scan

Log configuration change indicator. 
Valid values are:

• 0 - no change
• 1 - configuration has been modified

Enables you to control the values for the LOGStatus parameter Valid values are:

• 0 - The LOGStatus parameter is set to 7 if any error is found while scanning the XML file
• 1 - The LOGStatus parameter is set to 7 only if the XML file contains invalid document structure (non-XML); XML syntax errors are ignored
• 2 - The LOGStatus parameter is never set to 7

A value of 7 for the LOGStatus parameter refers to an invalid XML file.

If set to 1, only one event is generated per search criterion independent of the number of matches found.

The generated event contains the total number of matches found and the last matched text for the search criterion. The value is stored in /PMG/CONFIG/customEvtMatchCount.

Enables you to set the time in minutes that BMC PATROL KM for Log Management waits before deleteing the pmgreader binary

from a remote host if you delete all of the instances that you had configured for it. The default value is 10.

The value is stored in /REMOTE/HOSTS/HostName/PMG/delPmgreaderAfterMin.

dispFullName

Displays full names of the filesystem instances.

You can display the full name of a filesytem instances by setting the PMG/CONFIG/dispFullName variable value to 1:

 /PMG/CONFIG/dispFullName=1

If you set the dispFullName variable value to 0, the filesystem instance name is truncated:

/PMG/CONFIG/dispFullName=0

The default value is 0.

Limits the amount of time that the KM spends scanning files You need to manually add the /PMG/CONFIG/fileScanTimeLimit variable.

You can set its value as 1 to limit the amount of time that the KM spends scanning files.

This is a global variable so the time limit set in this variable is split between all of the LOGMON instances. The time allocated for each LOGMON instance

is fileScanTimeLimit divided by the total number of LOGMON instances. If the variable is set to a value other than 1, the KM does not limit the time it takes to scan files.

If the fileScanTimeLimit variable is set to 1, the total scan time limit is 2 minutes. The KM derives this from the default polling cycle, which is 2 minutes.

Therefore, if the total number of LOGMON instances is 4, each instance has a scan time limit of 30 seconds. This polling time is added after the polling cycle starts at 2 minutes.

Thus, the maximum time for data collection is 4 minutes. If the fileScanTimeLimit variable is set to anything other than 1, the KM works normally.

If the KM is monitoring a large file, and fileScanTimeLimit is set to 1, the KM continues scanning in multiple polling cycles,

and the LogStatus parameter is set to a value of 2. If the KM is monitoring a normal size file and completes scanning within the limit, the LogStatus parameter is set to a value of 1.

Holds the value of the file size growth limit in kilobytes. If the KM determines that the difference between the old file size and the

new file size is greater than the value in the fileSizeGrowthLimit variable, it does not perform scanning.

This feature is applicable only for text files. You can add the /PMG/CONFIG/fileSizeGrowthLimit variable to stop scanning of text files when

scalability limits have been reached. Set the value of the variable by using X to indicate the growth limit in kilobytes.

The pconfig variable is added globally and is applicable to all the LOGMON instances. 

If the file size growth is more than the value of the fileSizeGrowthLimit variable, the following actions occur:

• scanning is not done for this file during the polling cycle
• data added during the polling cycle is skipped from scanning
• the LogStatus parameter goes into an alarm and is set with a value of 6
• the offset is set to the end of the file for the next polling cycle

This variable is used for ignoring the script return code in case of script monitoring. So, this can resolve a situation of missing/unknown alert when the script executes properly but it is returning a non-zero code.

• 0 - (Default value)
• 1 – The script execution return code will be ignored.

Controls the number of old instances to be monitored when the File Disposition option in the Add File for Label: instanceName dialog box is set to Latest.

The value is stored in the pconfig variable /PMG/CONFIG/numOldInstances. The default value for numOldInstances is 1.

Specifying a null string for the Number of Old Instancescauses the KM to delete this variable and revert to the default of 1. If the File Disposition option in the Add File for Label: instanceName dialog box is set to All, the KM ignores the numOldInstances variable.

Monitors the latest file with a single permanent Log file instance.

• 0 - Enables creation of multiple instances while monitoring the latest file set
• 1 - Enables creation of a single instance while monitoring the latest file set

Controls the format of the origin name in the Event Manager. PNn is a suffix used with the LOGMON instance.

(For example, if the name of a LOGMON instance is Test, you see TestPN0 and TestPN1 in the Event Manager.) 
Valid values are:

• 0 - uses naming convention with PNn
• 1 - uses naming convention without PNn; instead of PNn, the file name is added

From version 2.7.00 of PATROL KM for Log Management onwards, you can configure the originNameInEM variable at the

KM level and the instance level to disable the use of a PNn suffix. Instead, the origin name displays the file name of the latest version of the file being monitored.

Replaces the special characters (Comma ( , ), double quotation marks ( " ), and single quotation marks ( , )) in the custom event message with tags instead of deleting them from the message.

• 0 - Disabled
• 1 - EnabledBoolean

Describes the label for a search criterion that you define. Each time you define a search criterion, this variable is

created with the same name as that of the search identifier.

This variable is a collection of fields and is created under the /PMG/CONFIG/instanceName/actPatterns pconfig branch.

Enables you to suppress multiple consecutive spaces in a custom event message. You need to add this variable manually under the /PMG/CONFIG branch.

You can assign one of the following values:

• 1 - Suppresses multiple consecutive spaces and considers them as a single delimiter
• 0 (default) - Does not suppress multiple consecutive spaces and considers them as multiple delimiters

Suspends all the instances configured under PATROL KM for Log Management 
Valid values are:

• 0 - removes suspension from all the instances
• 1 - suspends all the instances

If you set the /PMG/CONFIG/suspendAll variable to a value of 1, it skips text added during the suspension period. After the period lapses,

the KM reads from the end of the file. When using the KM interface, the suspendAll variable and thePMGSuspend flag file take precedence over the Suspend KM event generation for a specified time period option.

Generates only a single event instead of two events for exceeding a defined threshold. 

 You can generate a single event by setting the PMG/CONFIG/sendSingleEvent variable value to 1:

/PMG/CONFIG/sendSingleEvent=1

If you set the sendSingleEvent variable value to 0, then two events are generated for exceeding a defined threshold, out of which, one event is generated from BMC PATROL for Log Management and the other from the BMC PATROL for Event Management. 

/PMG/CONFIG/sendSingleEvent=0

The default value value is 0.

Enables the KM to read the log file from the last read point in the previous scan when the configuration of the monitored log file changes.

The value is stored in the pconfig variable /PMG/CONFIG/updateOnConfigChange. 

Valid values are:

• 0 - the log file instance is deleted
• 1 - the log file instance is not deleted

The default behavior of the KM is to destroy and re-create the log file instance and read the log file from the beginning whenever the

configuration of the monitored log file changes. If the pconfig variable /PMG/CONFIG/updateOnConfigChange has a value of '1',

the instance is not destroyed and the KM reads the file from the last read point in the previous scan.

Enables you to reduce the size or truncate log files without reading from the beginning each time that the file is reduced.

• 0 - log files that are reduced in size read from the beginning of the file
• 1 - log files that are reduced in size read from the end of the file

If the value is 1, then monitored logs are not read until the next scan.

If the configuration variable is missing, that is, if you have not added this variable manually, the log file is read from the beginning of the file.

Notes:

This variable works only when the log file is a text file. It does not work if the file type is binary or script.

Whenever the file timestamp is modified, but the file size remains same, the KM starts reading the file from the beginning.

Limits the amount of data that is sent to the LOGMatchString parameter. By default, 63K is the maximum amount of data sent to the this parameter.

Enter any integer > 0 as value for this variable to indicate the character limit for the amount of data sent to the LOGMatchString parameter.

Note: The value of this variable must be less than or equal to 63K.

Enables you to select what the KM must do when a monitored file is deleted:

• 1 - Generate an ALARM (default)
• 2 - Do nothing
• 3 - Delete the instance