!--a11y-->
Structure of the Log File Template of
the Log File Agent 
The log file template contains information about which text files are to be analyzed in which form.
The following parameters of the log file template apply to all log files that fulfill the conditions for DIRECTORY and FILENAME:
LOGFILE_TEMPLATE |
Key word for the agent; opens a search area |
DIRECTORY="<directory>" (required parameter) |
Directory that contains the log file |
FILENAME="<file name>" (required parameter) |
Name of the log file; wildcards are permissible |
MONITOR_CONTEXT="<context name>" |
Name of the monitoring context in which the log file agent writes the monitoring results; by default, this is the context Files_of_<Hostname>. Regardless of whether or not you set this parameter, the MTE class of the monitoring context is always CcmsFileMonitoring. By specifying this MTE class, you can define a rule-based monitor that contains the subtrees for all monitored log files. In this way you can, for example, store monitored log files for different components in different contexts, to further group the results. Like the PREFIX parameter (see below), this function allows you to differentiate between the different monitored log files, but, unlike PREFIX, provides an additional hierarchical level to group the monitored files. Use this parameter only if you require this additional hierarchical level. |
IGNORE_CASE=[0,1] (Default = 0) |
By default, all search patterns are case-sensitive (0). If upper and lower case are to be ignored, set IGNORE_CASE=1. |
MONITOR_NEWEST_FILES=<number> (Default = 20) |
Maximum number of files that is to be monitored; if the number of files whose names fulfill the search criteria exceeds this number, exactly <number> files with the newest change time are monitored. This means that different files are monitored over time. If a file is removed from monitoring because other files have a newer change date, its monitoring tree is deleted, and its alerts are reset. The maximum value for number is also 20, to avoid storing an unnecessarily large quantity of data in the monitoring architecture. |
RESCANFROMBEGIN=[0,1] (Default = 0) |
Specifies whether each new read operation reads the log file from the start (1) or only the lines that have been added since the log file agent last read the file (0) |
MONITOR_FILESIZE_KB=<file size[KB]> (Default: FileSize is not created) |
Value < 0: FileSize is not created. Value = 0: Size of the log file in KB is monitored in the node FileSize Value > 0: The size of the log file in KB is monitored; if the file size exceeds the value, an alert is generated |
PREFIX="<character string>" |
Appears before the MTE nodes; allows you to differentiate between different log files with different paths, but the same name |
SHOWNEWLINES=[0,1] (Default = 0) |
Value=1: The Alert Monitor creates the subnode Newlines; that is, the number of lines created per minute is reported Value=0: Newlines is not created |
ANALYZEMETHOD="<method name>" (Default: no method) |
Analysis method that is assigned to the alert |
MONITOR_LAST_FILE_MODIF=[0,1] (Default = 0) |
Specifies whether a separate performance node File Time Stamp is to be created, which then monitors the last change time point of the log files (1), or whether the last change time point is not to be monitored (0) |
MTE_CLASS="<MTE class>" (Default: CcmsFile<file name>) |
MTE class of the monitoring object that contains the attributes specified above; the MTE class of the monitoring objects therefore depends on the name of the monitored log file |
CHECK_EXISTENCE_ONLY=[0,1] (Default = 0) |
Specifies whether the system is to check only for the existence of the log files (1). In this case, all parameters for monitoring and for search patterns (see below) are ignored. |
REPORT_MATCHING_LINES_ONLY=[0,1] (Default = 0) |
By default, all lines of the monitored log file are reported in the log attribute Lines found for pattern– even if the search pattern is not included in the relevant line. If you set this parameter, only the lines that contain the relevant search pattern are copied to the agent’s shared memory.
If you set this parameter, and the value Last incoming message is set for the setting Display “current value” like, the last matching line is always displayed in the log attribute in the Current Status view in the Alert Monitor. |
You can specify multiple search patterns to be monitored for each of the log files that fulfills the conditions for DIRECTORY and FILENAME. When doing this, enter a number <x> for each search pattern in the parameter suffix of the following parameters. Start with the number 0.
PATTERN_<x>="<character string>" (PATTERN_0 is required) |
Search pattern in the log file (case sensitive; wildcards are not allowed) |
MESSAGEID_<x>="<message ID>" Default = RT 149 |
Message number that is assigned to the alert |
VALUE_<x>=[RED,YELLOW,GREEN] Default = YELLOW |
Color of the alert in the monitoring architecture |
SEVERITY_<x>=[0...255] Default = 0 |
Severity of the alert |
MESSAGECLASS_<x>="<message class>" Default = SAP-T100 |
Message class |
CMP_FROM_BEGIN_<x>=[0,1] Default = 0 |
Value=1: The line must begin with the search pattern (better performance) Value=0: The search pattern can be in any position in the line |
You can use the parameters explained above to monitor log files for search patterns to which an alert is to be assigned (for example, to the search pattern Error). This function is not ideal for displaying search patterns to which no alert is to be assigned (such as version or date information). Only one log attribute is available in the Alert Monitor for all monitored search patterns, meaning that only one line is displayed even in the case of multiple search patterns.
There is therefore a second way in which you can monitor log files for search patterns. If a search pattern of this type is found, the Alert Monitor displays the corresponding line as the content of a separate text attribute. You can define the name of the text attribute yourself. If the search pattern exists at several places in the log file, the system displays the last position in which it is found.
APPL_INFO_<x>="<character string>" |
Search pattern in the log file (case sensitive; wildcards are not allowed); if the search pattern is found, the system displays the line of the log file in which the search pattern was found in the Alert Monitor |
APPL_INFO_MTE_NAME_<x>="<MTE_Name>" |
Name of the text attribute in which the line is displayed; the complete node name is INFO[<MTE name>] |

· Note that you must end the file with a period (.).
· If parameters are required, this is highlighted. All other parameters are optional.
See Example Log File Templates
CCMS Agents start
page, Monitoring Log Files
with CCMS Agents