Defining Sniff Patterns

You can define a pattern matching string, called a sniff pattern, to monitor entries in a log file. You can also edit existing sniff patterns.

The sniff pattern is a text string that is used to search log file entries. The sniff pattern can be any text string or regular expression. When log entries match the sniff pattern, annotated data points are created in the LogEvent parameter (if annotation is turned on), and entries are written to the PATROL event log for monitoring by the PATROL Event Manager (if the event trigger option is turned on). Only if these options are activated are the actions taken.

Before you begin

Ensure that you have completed the following items:

• installed the PATROL for Oracle Tuxedo PATROL for Oracle Tuxedo and PATROL for Oracle Tuxedo and have them running
• loaded and configured the PATROL for Oracle Tuxedo PATROL for Oracle Tuxedo for Tuxedo

To Define a Sniff Pattern

1. Double-click the APPS_LOGS icon.
2. Right-click the log instance icon.
3. Choose KM Commands => Sniff Pattern Setup => Edit Sniff Pattern.
    The Log Sniff Setup dialog box appears.
   
4. Select Add.
5. Click Take Action.
    The Add New Log Sniff Pattern dialog box appears.
   
6. Complete the dialog box as follows:

   • In Sniff Pattern, type the text string that you want matched. Any text string or regular expression is valid in this field.
     
     Information about error messages can be found in the documentation for Tuxedo, PeopleSoft, or your other applications. A list of Tuxedo pre-defined error messages is available through the BEATUX_SYSTEM KM command Reports => System Message Query. For more information, see Initiating a System Message Query Report. 

     Warning

     Note

     The LogEvent parameter counts only the first occurrence of the sniff pattern in a line.

   • In Event Type, select the event type from the pull-down list.
     
     Available types are ERROR, WARNING, and INFORMATION. If you check the PATROL Event Trigger box, the event is also logged in the PATROL event log and can be monitored through the PATROL Event Manager. You can define your own event class to be recorded in the PATROL event log, or the PATROL KM will use the classes ERROR_PATTERN, WARNING_PATTERN, and INFORMATION_PATTERN corresponding to your selection from the pull-down list.

   • Check Annotate Information if you want annotated data points on your parameter graphs. 

     Error

     Warning

     The PATROL Agent cannot handle large amounts of annotated data. Use the Annotate Information feature selectively.

   • In Pattern Threshold, enter the number of times that a pattern must be registered before an event is sent to the PATROL Event Manager.
7. Click OK.
    The Log Sniff Setup dialog box reappears.
8. You have the following options at this point:
   • Select one of the following actions:
     • Add to define additional sniff patterns
     • Update to change your patterns
     • Delete to remove a sniff pattern
     • Exit to close the Log Sniff Setup dialog box

   • Click Take Action to perform the selected action. 

     Warning

     Note

     When a sniff pattern is registered, the pattern is matched against the last 10 lines of the log file, and then automatically for any new data written to the file.

Where to go from here

To view the log file entries matching the sniff pattern string, use the PATROL Event Manager.

To stop applying the sniff pattern string matching to your log files, see Turning Off and Restarting Sniff Pattern Matching.