DX Unified Infrastructure Management

Hello,

Trying to monitor specific message in log file and alert if the message is not appeared in last x mins.

Eg : currently I am monitoring string "xyz" from specific log file and which is getting updated at every 1 or 2 mins interval. I want to alert if the string "xyz" did not updated from last 10 mins in the log file.

Regards - Ripple

Try the advanced setting: match on every run.

If this is activated than your "message to send on match" is in fact a "message to send when no match found"

This will no help as it is for count of alarms and I am looking for alert on "xyz" did not updated from last 10 mins in the log file.

Did you try it?

yes, gone through the steps but no luck.

attached: sample logmon watcher that:

- send an alarm when the string "beat" is found (only as debug) in the monitored file

- if the string "beat" is not found during 10 minutes it will generate an alarm

(if i understood correctly what you want)

Right, - if the string "beat" is not found in last 10 minutes it should generate an alarm.

Thank you for sharing the sample log file I tried to configure same way but it is not helpful in our environment.

To monitor if something didn't happened I use this script, it basically checks your Alarm History and if it's not there then it alerts you

rc = database.open("provider=nis;database=nis;driver=none")

query = "SELECT message from nas_transaction_summary where created > DATE_SUB(CURRENT_TIMESTAMP(),INTERVAL 15 MINUTE) and message like 'EXPECTED ALARM TEXT%' union select 'Dummy Record' from dual limit 1;"

alarms, rc = database.query(query)

for _, al in pairs (alarms) do

message = "EXPECTED ALARM TEXT has not happened"
SUPPKEY = "INSERT_SUPP_KEY"
SUBSYS = "1.1"
SOURCE = "INSERT_SOURCE"

if regexp (al.message,"*EXPECTED_TEXT*")

--then print (al.message)

then print ("Everything is fine")

--else print (al.message)

else nimbus.alarm (4, message , SUPPKEY , SUBSYS , SOURCE)

database.close()

end

end

You'll need to insert a dummy record into your DB so if nothing is found then the dummy record appears as a result, the regex can then scan this text.  I found regex doesn't work with Blank values.

Hope it helps.