Monitor file on Collection Agent
You can create a data collector to collect logs from a particular host.
Related topics
To locally collect files from a host
- Navigate to Administration > Data Collectors > Add Data Collector
.
- In the Name box, provide a unique name to identify this data collector.
- From the Type list, select Monitor File on Collection Agent.
Provide the following information, as appropriate:
Field
Description
Target/Collection Host
Collection Host (Agent)
Type or select the collection host depending on whether you want to use the Collection Station or the Collection Agent to perform data collection.
The collection host is the computer on which the Collection Station or the Collection Agent is located.
By default, the Collection Station is already selected. You can either retain the default selection or select the Collection Agent.
Note: For this type of data collector, the target host and collection host are expected to have the same values.
Collector Inputs
Directory Path
Provide the absolute path of the log file.
To retrieve log files from subdirectories, do not provide the absolute path; instead, provide the path up to the parent directory.
Include subdirectories
(Optional) Select this check box if you want to retrieve log files from subdirectories of the file path specified.
Filename/Rollover Pattern
Specify the file name only, or specify the file name with a rollover pattern to identify subsequent logs.
You can use the following wild card characters:
- Asterisk (*)—Can be used to substitute zero or more characters in the file name.
- Question mark (?)—Can be used to substitute exactly one character in the file name.
Specifying a rollover pattern can be useful to monitor rolling log files where the log files are saved with the same name but differentiated with some variable like the time stamp or a number.
Note: Ensure that you specify a rollover pattern for identifying log files that follow the same data format (which means they will be indexed with the same data pattern).
Time Zone
Data Pattern
Pattern
Date Format
When you select a data pattern, the matching date format is automatically updated. However, you can specifically find date formats matching the timestamp in your data file.
Use one of the following methods to specify a date format:
- Filter the relevant data formats: Click Auto-Detect to find automatically find a list of matching data patterns and date formats. If no matching data patterns are found, a list of matching date formats is displayed. You can click each of the date formats displayed on the left, to see a preview of the sample records.
- Manually select a date format: Manually scan through the list available, and select one of the date formats available. Click Preview to see the sample records parsed.
Alternatively, from the Pattern list, select Free Text with Timestamp and click Preview to find the relevant data formats that match the file. - Create a new date format: If you are not satisfied with the results arising out of the date formats available, you can create a new date format. To do this, select the Create new Date Format option and manually enter the date format depending on the timestamp that you want to capture. For example, if your data file contains the timestamp, "28 Apr 2014 10:58:28", then your date format must be dd MMM yyyy HH:mm:ss.
Notes:
- If you select both – a pattern and a date format, then the date format specified takes precedence over the date format from the pattern that you selected. So the timestamp is indexed as per the specified date format, and the rest of the data is indexed as per the pattern.
- If you select only a date format, then the date format is used for indexing the timestamp, while the rest of the data is displayed in a raw format in your search results.
Poll Interval (mins)
Enter a number to specify the poll interval (in minutes) for the log collection (0 indicates that this is a one-time log collection).
By default, this value is set to 1.
Start/Stop Collection
(Optional) Select this check box if you want to start the data collection immediately.
- Click Create to save your changes.