Page tree

You can create a data collector to upload individual log files (up to 10 MB in size) from the computer on which you are accessing the product Console.

Note

BMC recommends that you not use this data collector for files that are updated dynamically.

Only that data which is present in the file at the time of uploading is collected. Any additional data added to the file, after the file is already uploaded into the system, does not get collected.

This topic contains the following information:

Related topics

To configure an individual file as a data collector

  1. Navigate to Administration > Data Collectors > Add Data Collector .
  2. In the Name box, provide a unique name to identify this data collector.
    From the Type list, select Upload file.
    Provide the following information, as appropriate:

     

    FieldDescription
    Target/Collection Host
    Target Host

    (Optional) Select from a list of hosts that you have already configured under Administration > Hosts.

    The target host is the computer from which you want to retrieve the data. You can choose to select the target host and inherit the host-level tags and group access permissions already added to the host, or manually enter the host name in the Server Name field.

    Collection Host (Agent)

    Type or select the collection host depending on whether you want to use the Collection Station or the Collection Agent to perform data collection.

    The collection host is the computer on which the Collection Station or the Collection Agent is located.

    By default, the Collection Station is already selected. You can either retain the default selection or select the Collection Agent.

    Note: For this type of data collector, the target host and collection host value is the same.

    Collector Inputs
    Server Name

    Enter the host name of the server from which you want to retrieve the data.

    Note: If you selected a target host earlier, this field is automatically populated. The value of this field is necessary for generating the "HOST" field that enables effective data search.

    This field is mandatory to enable you to search data that you are uploading by host name.

    File PathProvide the path of the log file.
    Time Zone

    By default, the Use file time zone option is selected. This means the data is indexed as per the time zone available in the data file. If the data file does not contain a timezone, then the by default the time zone of the Collection Host (Collection Station or Collection Agent) server is used.

    You can also manually select a timezone from the list available. This timezone must match the timezone of the server from which you want to collect data. If your data file contains a timezone and you manually specify the timezone, then the manually specified timezone overrides the file timezone.

    Data Pattern
    Pattern

    Select the appropriate data pattern to use for indexing the data file.

    To select an option, you can do one of the following:

    • Filter the relevant data patterns that match the file.
      To find a list of relevant data patterns, click Filter Relevant Data Pattern and Date Formatnext to this field. Click Refresh to refresh the filtered list and see the complete list of data patterns available.
    • Manually scan through the list available and select a data pattern.

    After selecting an option, click Preview parsed log entries to preview the sample data entries parsed. By looking at the preview of records, you can understand how the data will be indexed and be made available for searching.

    If you are not satisfied with the results of the selected data pattern, continue to look for another option and see the preview, until the results match your expectations.

    If you do not find a relevant data pattern, you can do one of the following:

    • Select a date format from the Date Format list to capture the timestamp and rest of the event data in a raw format.
      Note: If you select both – a pattern and a date format, the product uses the date format to index the timestamp and the pattern to index rest of the event data.
    • Use Free text to capture data in a raw format, based on the time when it is indexed by the product.
    • Select Add Data Pattern available at the end of the list. By selecting this option, you are redirected to the Administration > Data Patterns page where you can create a new data pattern or customize an existing data pattern by cloning it. For more information, see Managing data patterns.
    Date Format

    Select a date format to use for indexing the timestamp in the data file.

    To select an option, you can do one of the following:

    • Filter the relevant data formats that match the file.
      To find a list of relevant data patterns, click Filter Relevant Data Pattern and Date Formatnext to the Pattern field. Click Refresh to refresh the filtered list and see the complete list of data patterns available.
    • Manually scan through the list available and select a date format.

    After selecting an option, click Preview parsed log entries to preview the sample data entries parsed. By looking at the preview of records, you can understand how the data will be indexed and be made available for searching.

    If you do not find a relevant date format, you can also create a new date format by selecting the Create new Date Format option.

    Notes:

    • If you select both – a pattern and a date format, then the date format specified takes precedence over the date format from the pattern that you selected. So the timestamp is indexed as per the specified date format, and the rest of the data is indexed as per the pattern.
    • If you select only a date format, then the date format is used for indexing the timestamp, while the rest of the data is displayed in a raw format in your search results.
    Read from Past (#days)

    Indicates the number of days for which past data can be collected and indexed. The maximum amount of past data that can be collected into the system is defined by the data retention period (default 7). You can change this value by navigating to Administration > System Settings.

    By default, this value is set to 7.

    Recommendation: BMC recommends you to not use a very high value in this field (for example, 365). This is necessary to avoid a very large amount of data collected into the system in a short time.

    File Encoding

    If your data file uses a character set encoding other than UTF-8 (default), then do one of the following:

    • Filter the relevant character set encodings that match the file.
      To do this, click Filter relevant charset encoding next to this field.
    • Manually scan through the list available and select an appropriate option.
    • Allow IT Data Analytics to use a relevant character set encoding for your file by manually select the AUTO option.
    Ignore Data Matching Input

    (Optional) If you do not want to index certain lines in your data file, then you can ignore them by providing one of the following inputs:

    • Provide a line that consistently occurs in the event data that you want to ignore. This line will be used as the criterion to ignore data during indexing.
    • Provide a Java regular expression that will be used as the criterion for ignoring data matching the regular expression.

    Example: While using the following sample data, you can provide the following input to ignore particular lines.

    • To ignore the line containing the string, "WARN", you can specify WARN in this field.
    • To ignore lines containing the words both "WARN" and "INFO", you can specify a regular expression .*(WARN|INFO).* in this field.
    Sample data
    Sep 25, 2014 10:26:47 AM net.sf.ehcache.config.ConfigurationFactory parseConfiguration():134
    WARN: No configuration found. Configuring ehcache from ehcache-failsafe.xml  found in the classpath:
    
    Sep 25, 2014 10:26:53 AM com.bmc.ola.metadataserver.MetadataServerHibernateImpl bootstrap():550
    INFO: Executing Query to check init property: select * from CONFIGURATIONS where userName = 'admin' and propertyName ='init'
    
    Sep 30, 2014 07:03:06 PM org.hibernate.engine.jdbc.spi.SqlExceptionHelper logExceptions():144
    ERROR: An SQLException was provoked by the following failure: java.lang.InterruptedException
    
    Sep 30, 2014 04:39:27 PM com.bmc.ola.engine.query.ElasticSearchClient indexCleanupOperations():206
    INFO: IndexOptimizeTask: index: bw-2014-09-23-18-006 optimized of type: data
    Best Effort Collection

    (Optional) If you clear this check box, only those lines that match the data pattern are indexed; all other data is ignored. To index the non-matching lines in your data file, keep this check box selected.

    Example: The following lines provide sample data that you can index by using the Hadoop data pattern. In this scenario, if you select this check box, all lines are indexed. But if you clear the check box, only the first two lines are indexed.

    Sample data
    2014-08-08 15:15:43,777 INFO org.apache.hadoop.hdfs.server.datanode.DataNode.clienttrace: src: 
    /10.20.35.35:35983, dest: /10.20.35.30:50010, bytes: 991612, op: HDFS_WRITE, cliID:
    
    2014-08-08 15:15:44,053 INFO org.apache.hadoop.hdfs.server.datanode.DataNode: Receiving block 
    blk_-6260132620401037548_683435 src: /10.20.35.35:35983 dest: /10.20.35.30:50010
    
    2014-08-08 15:15:49,992 IDFSClient_-19587029, offset: 0, srvID: DS-731595843-10.20.35.30-50010-1344428145675, blockid: 
    blk_-8867275036873170670_683436, duration: 5972783
    
    2014-08-08 15:15:50,992 IDFSClient_-19587029, offset: 0, srvID: DS-731595843-10.20.35.30-50010-1344428145675, blockid: 
    blk_-8867275036873170670_683436, duration: 5972783

    Inherit Host Level Tags From Target HostSelect this check box to inherit your tag selections associated with the target host that you selected earlier. This option is not applicable if you did not select a target host.
    Select Tag nameYou can manually add tags by selecting one of the tags in the list, specifying a corresponding value, and clicking Add . The list of added tags is displayed in the Tags pane on the Search tab.
    Click Remove Tag to remove a tag.

    Inherit Host Level Access Groups From Target HostSelect this check box to inherit your group access configurations associated with the target host that you selected earlier. This option is not applicable if you did not select a target host.
    Select All Groups

    Select this option if you want to select all user groups. You can also manually select multiple user groups.

    If you do not select any user groups and data access control is not enabled, then by default all users can access data retrieved by this data collector. You can restrict access permissions by selecting the relevant user groups that must be given access permissions. To enable data access control, navigate to Administration > System Settings.

    If you do not select any user group and data access control is enabled, then only the creator of the data collector has access to data retrieved by this data collector.

    For more information, see Managing user groups.

  3. Click Create to save your changes.

Collecting data higher than the default limit

If you want to collect data that is higher than the default limit (10 MB), then you must add the collection.upload.maximumAllowedFileSizeInMB property in the olaengineCustomConfig.properties file located at %BMC_ITDA_HOME%\custom\conf\server. The value of this property is the size of data (in MB) that you want to collect.

For example, if you want to collect data that is 25 MB in size, then you need to add the property, as follows:

collection.upload.maximumAllowedFileSizeInMB=25

After adding the property, save the file, and then restart the service for the Console Server. For more information, see Starting or stopping product services.

Recommendation

BMC recommends you to not upload files higher than 100 MB in size because this might lead to the data collector timing out.