Hi I am very sorry if I caused any confusion.
As I stated I did not have a chance to test this in longmon. I just reviewed your regex as your asked and provide a working regex statement.
I did do some testing in logmon but as I am unlcear what exactly you need to alarm on I could only guess is that you want to check the status field for failed or some other value.
I created the following log file:
[
{
"Application": "items-inventory-api-mos-test items_inventory_api-v1.0-external-3.8.x.zip",
"Status": "FAILED",
"Updated": "a month ago"
}
]
[
{
"Application": "items-inventory-api-mos-test items_inventory_api-v1.0-external-3.8.x.zip",
"Status": "STARTED",
"Updated": "a month ago"
}
]
[
{
"Application": "items-inventory-api-mos-test items_inventory_api-v1.0-external-3.8.x.zip",
"Status": "FAILED",
"Updated": "a month ago"
}
]
[
{
"Application": "items-inventory-api-mos-test items_inventory_api-v1.0-external-3.8.x.zip",
"Status": "STARTED",
"Updated": "a month ago"
}
]
They setup the following profile for logmon and was able to alert on the failed status.
<testFormat>
active = yes
interval = 5 sec
scanfile = C:\Temp\multilineformat.log
fileencoding =
scanmode = cat
alarm = yes
qos = yes
message = no
subject =
user =
resetFile = no
initialfileptr = 2
resumefileptr = 4
command_timeout_active = no
command_timeout =
command_severity = 2
command_timeout_alarm = 0
alarmFOpenFail = no
clearFOpenFailRestart = no
monitor_exit_code = No
max_alarm_sev = 5
max_alarms =
max_alarm_msg =
password =
<formats>
<formatrule>
active = yes
start = /(Application)\W+(.*zip).*/
end = /(Updated)\W+(.*\w+)/
lines = 0
</formatrule>
</formats>
<watchers>
<watcher test>
active = yes
match = /(Status)\W+((?!STARTED)\w+).*/
level = warning
subsystemid =
message = ${WATCHER} - Messag: ${var}
i18n_token =
restrict =
expect = no
abort = no
sendclear = no
count = no
separator =
suppid =
source =
target =
qos =
runcommandonmatch = no
alarm_on_first_match = no
commandexecutable =
commandarguments =
pattern_threshold_severity = information
pattern_threshold_message =
timeout = 1
pattern_threshold =
expect_message =
expect_level =
regexfromexternalfile = no
patternfilepath =
token =
<variables>
<var>
definition = *
</var>
</variables>
</watcher test>
</watchers>
</testFormat>
hope this helps