bvloch

Logmon: Can it solve this issue

Discussion created by bvloch on May 16, 2013
Latest reply on May 30, 2013 by jonhcw

So I am trying to monitor a logfile that after 96 characters the line is broken out onto a new line (complete with a new time stamp)

 

130513-023001: ANR2578W Schedule WIN_SM_HRC_INCR_2030 in domain WIN_SM_HRC for node BTVSACGP01
130513-023001: ANR2578W Schedule WIN_SM_HRC_INCR_2030 in domain WIN_SM_HRC for node BTVSACGP02
130513-023001: ANR2578W Schedule WIN_SM_HRC_INCR_2030 in domain WIN_SM_HRC for node BTVSACGP03
130513-023001: ANR2578W Schedule WIN_SM_HRC_INCR_2030 in domain WIN_SM_HRC for node
130513-022501: ANR2578W Schedule NOTESM2_ARCHIVELOGS in domain DOMINO_HRC for node AIX51_DOMI-
130513-022501: NO has missed its scheduled start up window.

 

I can easily match the string I want to alert on, however in the alarm text I need to include the string contained after the word node. My issue is that sometimes this string will appear on the first line, sometimes it will appear partially on both lines and when it does it is separated by a time stamp. It is also possible that it may not appear at all in the line in which the string I match on to generate the alarm (the string before the word "Schedule") is found.

 

The application that writes to the logfile cannot be configured to not multiline, or increase the character limit of the line.  Any thoughts on how I can always include the string as the word node using logmon? Can logmon even perform multiline regex's? 

Outcomes