steve.burt

Logmon Custom Variable Issue..

Discussion created by steve.burt on Jun 7, 2010
Latest reply on Jun 7, 2010 by richard.hirst

Hi Folks,

 

I have an issue with the following logmon configuration, defined below

 

I get my match and an alert is created

 

Jun  7 10:42:09:322 [0006] logmon: DEBUG: checksum matches: 29347
Jun  7 10:42:09:322 [0006] logmon: DEBUG: got a match!
Jun  7 10:42:09:322 [0006] logmon: /usr/users/test/logs/test.log is modified
Jun  7 10:42:09:322 [0006] logmon: [test.log] MATCH [test - Unpack] on line 0
Jun  7 10:42:09:324 [0006] logmon: [test.log] test.log.TEST - Unpack: Alarm Message, severity=3, sid=1.1, msg='clss.log has generated an Infomation QOS alert in /usr/users/test/logs/test.log, no action is required Message Details: Total duration to process and unpack swaps data in milliseconds : 3000, '

 

Yet instead of recording 3000 in the custom qos table i get "1"?

 

Any help would be appreciated

 

Kind Regards

SB

 

<setup>
logfile = logmon.log
logsize = 100
cfg_ver = 2
debug = 1
</setup>
<profiles>
<test.log>
active = yes
interval = 3min
scanfile = /usr/users/test/logs/test.log
scanmode = updates
alarm = yes
qos = yes
message = no
max_alarms =
max_alarm_msg =
password =
subject =
user =
<watchers>
<Test - Unpack>
active = yes
match = /.*Total duration to process and unpack swaps data.*/
level = minor
subsystemid =
message = $PROFILE has generated an Infomation QOS alert in $FILENAME, no action is required Message Details: $strMessage, $var
restrict =
expect = no
abort = no
sendclear = no
count = no
separator =
suppid =
source =
target =
qos = QOS_TEST_UPLOAD
runcommandonmatch = no
commandexecutable =
commandarguments =
<variables>
<strMessage>
definition = $1
operator =
threshold =
qosactive =
qosname =
qostarget =
</strMessage>
<var>
definition = 102:
operator =
threshold =
qosactive = yes
qosname = QOS_TEST_UPLOAD
qostarget =
</var>
</variables>
</TEST - Unpack>
</watchers>
</clss.log>
</profiles>
<qos>
<QOS_TEST_UPLOAD>
name = QOS_TEST_UPLOAD
desc = TEST Upload
unit = Milliseconds
abbr = ms
</QOS_TEST_UPLOAD>
</qos>

Outcomes