Sending a notification when a string has been matched
If you are using the PATROL KM for Log Management in conjunction with the PATROL KM for Event Management, you can send an event, email, page or other notification when the PATROL KM for Log Management goes into alarm.
The following example is a ruleset that you could use in the PATROL KM for Event Management to capture the data from LOGMatchString for the instance and deliver this information in a notification when the LOGErrorLvl parameter of the LOGMON application class goes into Warn or Alarm for any BMC PATROL for Log Management definition.
{{PATROL_CONFIG "/AS/EVENTSPRING/LOGMON/__ANYINST__/LOGErrorLvl/arsAction" = \{ REPLACE = "6" \}, "/AS/EVENTSPRING/LOGMON/__ANYINST__/LOGErrorLvl/arsCmdType" = \{ REPLACE = "PSL" \},}}
"/AS/EVENTSPRING/LOGMON/__ANYINST__/LOGErrorLvl/arsCommand" = { REPLACE = "__udefvar__=get(\"/LOGMON/\".__instance__.\"/LOGMatchString/value\");" }
"/AS/EVENTSPRING/ALERT/MSG/LOGMON/__ANYINST__/LOGErrorLvl/msgBodyALARM" = { REPLACE = "%USERDEFINED% " },
"/AS/EVENTSPRING/ALERT/MSG/LOGMON/__ANYINST__/LOGErrorLvl/msgTextALARM" = { REPLACE = "%USERDEFINED% " }
"/AS/EVENTSPRING/LOGMON/__ANYINST__/LOGErrorLvl/arsCommand" = { REPLACE = "__udefvar__=get(\"/LOGMON/\".__instance__.\"/LOGMatchString/value\");" }
"/AS/EVENTSPRING/ALERT/MSG/LOGMON/__ANYINST__/LOGErrorLvl/msgBodyALARM" = { REPLACE = "%USERDEFINED% " },
"/AS/EVENTSPRING/ALERT/MSG/LOGMON/__ANYINST__/LOGErrorLvl/msgTextALARM" = { REPLACE = "%USERDEFINED% " }
For detailed instructions on configuring notification, see the PATROL Knowledge Module for Event Management Documentation.