Monitoring Log Files with Agents and the Alert Monitor (SAP Library

Monitoring Log Files with Agents and the Alert Monitor

Use

One of the functions of CCMS agents is monitoring log files. This log file agent is integrated into all agents. You can use it to search any text files (such as database alert logs or ITS log files) for any text patterns. The results are displayed in the Logfile Monitoring monitor of the SAP CCMS Monitors for Optional Components monitor set.

If the agent finds the line for which it is searching, it transfers it to the central monitoring system. You decide various details of the message using entries in the configuration files of the logfile agent:

Color and severity of the alert or the message
Assigned message
Assigned analysis method
Specifications about the position in the alert monitoring tree

You can specify the configuration file that contains the details about the monitoring with the LogFile parameter in the SAPCCMSR.INI file. You can use the parameter LogFile more than once and therefore specify more than one file. For each file, you can specify a search criterion for the name of a log file (that can apply to more than one log file) and various text patterns that are to be monitored.

Features

The configuration file of the log file agent contains information about which text files are to be analyzed in which form:

Parameter	Description	Default Value
LOGFILE_TEMPLATE	Key word for the agent; opens a search area
DIRECTORY= <Directory>	Directory that contains the log file
FILENAME= <File name>	Name of the log file; wildcards are permissible
MONITOR_NEWEST_FILES =<Number>	Maximum number of files that is to be monitored; if the number of files whose names fulfill the search criteria exceeds this number, the <Number> files with the newest change time are monitored This means that different files are monitored over time. If a file is removed from monitoring because other files have a newer change date, its monitoring tree is deleted, and its alerts are reset.	20
RESCANFROMBEGIN= [0,1]	Specifies whether each new read operation reads the log file from the start (0) or only the lines that have been added since the logfile agent last read the file (>0)	0
MONITOR_FILESIZE_KB= <File size in KB>	Value ³ 0: Size of the log file in KB is monitored in the node FileSize Value > 0: If the file size exceeds the value, an alert is generated Value < 0: FileSize is not created.	FileSize is not created
PATTERN_<x>= <character string>	Search pattern in the log file (case sensitive; wildcards are not allowed)
MESSAGEID_<x>= <message ID>	Message number that is assigned to the alert
VALUE_<x>= [RED, YELLOW, GREEN]	Color of the alert in the monitoring architecture	YELLOW
SEVERITY_<x>= [0..255]	Severity of the alert	0
MESSAGECLASS_<x>= <message class>	Message class	SAP-T100
CMP_FROM_BEGIN_<x>= [0,1]	Value=1: The line must begin with the search pattern (better performance) Value=0: The search pattern can be in any position in the line	0
PREFIX= <character string>	Appears before the MTE nodes; allows you to differentiate between different log files with different paths, but the same name
SHOWNEWLINES=[0, 1]	Value=1: Alert Monitor creates the subnode Newlines, that is, the number of lines created per minute is reported Value=0: Newlines is not created	0
ANALYSEMETHODE= <Method name>	Analysis method that is assigned to the alert	No method
MTE_CLASS= <MTE class>	MTE class that is assigned to the alert	File name of the log file

Note

The parameters DIRECTORY, FILENAME, PATTERN_<0>, and MESSAGEID_<0> are required, all others are optional.

You must end the file with a period (.).

The parameters whose names end with _<X> in the above table are assigned to the individual search patterns. Use a different digit in place of <x> for each search pattern. Begin with 0.

Example

A configuration file for a logfile agent that searches in a maximum of four files that begin with the prefix errorlog for the text patterns error and warning, and which transfers finds to the monitoring architecture:

LOGFILE_TEMPLATE
DIRECTORY="e:\mssql70b\log"
FILENAME="errorlog*"
MONITOR_NEWEST_FILES=4
MTE_CLASS="MS-SQL"
PREFIX="MS"
SHOWNEWLINES=1
ANALYZEMETHOD=""

PATTERN_0="ERROR"
VALUE_0=RED
SEVERITY_0=50
MESSAGECLASS_0="SAP-T100"
MESSAGEID_0="rt 98"
CMP_FROM_BEGIN_0=0

PATTERN_1="WARNING"
VALUE_1=YELLOW
SEVERITY_1=20
MESSAGECLASS_1="SAP-T100"
MESSAGEID_1="rt 99"
CMP_FROM_BEGIN_1=0
.

See also:

Installation of the CCMS Agents