Configuring Text Files

Enter the logical name of the instance that you want to monitor. A maximum of 80 characters are allowed in this field.

Enter the full path and the filename of the file that you want to monitor.

Note: To monitor log files that have dynamic names, use wildcard characters, such as * and ? to define the file name. For example, if a log file is named backup_date.log, where date changes each day, enter the log file name as backup_*.log.  

A maximum of 900 characters are supported in this field.

Select the check box if the full path contains environment variable and the path defined by the environment variable is resolved at run time.

Select this check box if you want the instance to generate an alarm if the monitored file is not modified periodically. Specify the time in minutes after which you want the KM to alarm if the file is not modified, in the minutes text box.

Select this check box if the KM goes into an alarm or a warning state because the search string is found and you want the KM state to return to OK if the search string is not found on the next scan.

Id=id1 
031605: Error: Disc Full 
Id=;MatchedLines 
/hd001 mounted as /opt 
SUMMARY:id1=1;

To include these specified number of lines in the generated event, after saving the configuration, add the /PMG/CONFIG/<instanceName>/appendLogEntryLinesToCustomEvent configuration variable (Configuration Variable > Add Configuration Variable with Value set as 1).

Select this check box if you want to scan the entire text file on each scan, rather than scanning only the new content.

Note: The text file is scanned only if the file changes.

Select the read position of a file after the PATROL Agent is re-initialized or when a new file matches the file path.

• Read from last offset - Log file reads from the last offset
• Read from end of file - Log file reads from the end of the file
• Read from beginning of file - Log file reads from the beginning of the file
• Use existing configuration - Log file is read from the last offset

Select the regex type that you want to use to prepare the search criteria.

Note: The ECMAScript option is not supported on the HP-UX platform.

Specify the string to nullify the alarm for the dual search feature. You can configure dual search for an instance so that the KM goes into the alarm state when any of the search criteria is found in the monitored file and nullifies the alarm when the nullify string is found in the monitored file.

You must specify the first string in the Search String 1 > String text box of the Pattern search criteria section and the nullify string in this text box. For the nullified customized events, the default custom event message is used (as provided in the Custom Event Message text box in the Pattern search criteria section).

If you specify Alarm up in the String1 text box and Alarm down in this text box, the KM goes into an alarm state when Alarm up is found in the monitored file and the alarm is nullified when Alarm down is found in the monitored file.

In the String text box, enter the search string in one of the following formats:

• A combination of XML elements and values that you want to find in the monitored file. For configuring XML search strings, see Rules for entering XML search strings.
• Search pattern(s) - Each search pattern must be a valid regular expression. 

If you do not want to match the entered string, select the NOT check box.

Examples:

• You want to search for the word 'error' in a file, enter error in the Search string 1 text box.
• You want to search for the words 'error' and 'fatal' in one line a file, enter error in the Search string 1 text box and fatal in the Search string 2 text box.
• You want to search for 'error', but 'warning' should not be present in the same line. In this case, enter error in the Search string 1 text box and warning in the Search string 2 text box. Select the NOT check box for the Search string 2 field.

Select this check box to custom-define the settings for each search criterion.

You can custom-define a search criterion with the settings that are different from the default settings.

In a data collection interval, enter the minimum number of times the search string matches are found. When the threshold is reached, events are generated with the state configured in the threshold state fields. If you do not configure thresholds, events are not generated even though strings are matched in a data collection interval.

Specify a different state and a different number of matches in Threshold #1 and Threshold #2. Ensure that value in Threshold #2 is greater than Threshold #1. To search for a minimum number of text strings across a number of collection intervals, enter values in the x:y format.

Example 1:

Threshold #1: 3

Threshold #2: 5

If a string matches 3 times in a data collection interval, threshold #1 is reached, an event is generated and the KM generates an alarm, warning, or OK message based on the value set in Threshold #1 state. Similarly, if the string matches 5 times, an event is generated and the KM generates the configured state message.

Example 2:

Threshold #1: 3:5

Threshold #2: 5:5

If a string matches 3 times in last 5 data collection intervals, an event is generated and the KM generates and alarm, warning, or OK message based on the value set in Threshold #1 state. Similarly, if the string matches 5 times in last 5 data collection intervals, an event is generated and the KM generates the configured state message.

Enter the customized origin for events. If you do not specify the origin, the KM uses the instance name as the default origin of events, which is APPCLASS.INSTANCE.textFileName.

You can use built-in macros (except the %x[-%y] macro) as the customized origin for events.

Specify the time threshold for which duplicate events are ignored.

Note: You can also modify the default search criterion settings after you configure the instance.

In a data collection interval, enter the minimum number of times the search string matches are found. When the threshold is reached, events are generated with the state configured in the threshold state fields. If you do not configure thresholds, events are not generated even though strings are matched in a data collection interval.

Specify a different state and a different number of matches in Threshold #1 and Threshold #2. Ensure that value in Threshold #2 is greater than Threshold #1. To search for a minimum number of text strings across a number of collection intervals, enter values in the x:y format.

Example 1:

Threshold #1: 3

Threshold #2: 5

If a string matches 3 times in a data collection interval, threshold #1 is reached, an event is generated and the KM generates an alarm, warning, or OK message based on the value set in Threshold #1 state. Similarly, if the string matches 5 times, an event is generated and the KM generates the configured state message.

Example 2:

Threshold #1: 3:5

Threshold #2: 5:5

If a string matches 3 times in last 5 data collection intervals, an event is generated and the KM generates and alarm, warning, or OK message based on the value set in Threshold #1 state. Similarly, if the string matches 5 times in last 5 data collection intervals, an event is generated and the KM generates the configured state message.

Select the state of the KM when a threshold is reached.

Enter the message that you want to be displayed in the events when your search string conditions are satisfied. For more information, see Customizing event messages.

Enter the customized origin for events. If you do not specify the origin, the KM uses the instance name as the default origin of events, which is APPCLASS.INSTANCE.textFileName.

You can use built-in macros (except the %x[-%y] macro) as the customized origin for events.

Specify the time threshold for which duplicate events are ignored.

Note: You can also modify the default search criterion settings after you configure the instance.