Hello,
Trying to monitor specific message in log file and alert if the message is not appeared in last x mins.
Eg : currently I am monitoring string "xyz" from specific log file and which is getting updated at every 1 or 2 mins interval. I want to alert if the string "xyz" did not updated from last 10 mins in the log file.
Regards - Ripple
This will no help as it is for count of alarms and I am looking for alert on "xyz" did not updated from last 10 mins in the log file.
yes, gone through the steps but no luck.
attached: sample logmon watcher that:
- send an alarm when the string "beat" is found (only as debug) in the monitored file
- if the string "beat" is not found during 10 minutes it will generate an alarm
(if i understood correctly what you want)
Right, - if the string "beat" is not found in last 10 minutes it should generate an alarm.
Thank you for sharing the sample log file I tried to configure same way but it is not helpful in our environment.
To monitor if something didn't happened I use this script, it basically checks your Alarm History and if it's not there then it alerts you
rc = database.open("provider=nis;database=nis;driver=none")
query = "SELECT message from nas_transaction_summary where created > DATE_SUB(CURRENT_TIMESTAMP(),INTERVAL 15 MINUTE) and message like 'EXPECTED ALARM TEXT%' union select 'Dummy Record' from dual limit 1;"
alarms, rc = database.query(query)
for _, al in pairs (alarms) do
message = "EXPECTED ALARM TEXT has not happened"
SUPPKEY = "INSERT_SUPP_KEY"
SUBSYS = "1.1"
SOURCE = "INSERT_SOURCE"
if regexp (al.message,"*EXPECTED_TEXT*")
--then print (al.message)
then print ("Everything is fine")
--else print (al.message)
else nimbus.alarm (4, message , SUPPKEY , SUBSYS , SOURCE)
database.close()
end
end
You'll need to insert a dummy record into your DB so if nothing is found then the dummy record appears as a result, the regex can then scan this text. I found regex doesn't work with Blank values.
Hope it helps.
Try the advanced setting: match on every run.
If this is activated than your "message to send on match" is in fact a "message to send when no match found"