Show TOC

Configuring Central Monitoring of Syslog MessagesLocate this document in the navigation structure

Use

You can use the CCMS monitoring infrastructure to monitor the system log, among other things (more information: Syslog). By default, the message text and criticality of the alert are taken from the settings in transaction SE92 ( Maintain Syslog Messages). However, you can also define the criticality and severity for a system log message directly in the alert monitor itself, by defining an alert filter. The relevant procedure is also described in Syslog Monitor.

You always need to perform this configuration locally, that is, in the relevant monitored systems. This can be a very time-consuming procedure, particularly in large landscapes.

It is therefore meaningful to centrally create filter settings for syslog messages for the monitored settings, and simply to distribute them to all desired monitored systems. A function for doing this is described in this section.

Features

When distributing filter settings, the table ALGLOBSYSLGFIL is the center, which you need to fill in the central monitoring system (CEN), and which contains the configuration settings to be distributed. The table has the following columns:

Column

Description

LINENUMBER

Positive whole number that defines the sequence in which the filter settings are assigned to the MTEs. The assignment starts with the smallest number and is continued in the order of the values. This means that settings with a lower LINENUMBER are overwritten by those with a higher LINENUMBER, if these relate to the same message ID.

SYSGROUP_OR_SID

System ID of the monitored system (this system must be configured in the monitoring infrastructure in accordance with Registering SAP NetWeaver Components and Hosts in CEN) or the name of the System Group to which the filter setting is to apply.

FROMAREA

Syslog messages have an ID consisting of three characters, which consists of a group (the first two characters) and a sub ID (the third character).

You can specify ranges of syslog messages in the table, and assign a particular criticality and severity to them in the CCMS monitoring infrastructure. The columns FROMAREA and FROMSUBID specify the start of a range of this type.

FROMSUBID

TOAREA

You can specify ranges of syslog messages in the table, and assign a particular criticality and severity to them in the CCMS monitoring infrastructure. The columns TOAREA and TOSUBID specify the end of a range of this type.

TOSUBID

MSGVALUE

Criticality that is to be assigned in the monitoring infrastructure to the messages in the range that you have just defined. In this context:

  • Red alert: MSGVALUE=1

  • Yellow alert: MSGVALUE=2

  • Green alert: MSGVALUE=3

SEVERITY

Severity that is to be assigned in the monitoring infrastructure to the messages in the range that you have just defined; the value must be between 0 and 255.

The alert assignments are distributed to the monitored systems using the report CSM_DISTRIBUTE_ALGLOBSYSLGFIL. We recommend that you schedule the report for regular execution as a job so that changes to the table ALGLOBSYSLGFIL are reliably transported to the monitored systems.

Activities

To use central configuration for monitoring of syslog messages, proceed as follows:

  1. Fill the table ALGLOBSYSLGFIL in CEN with the desired syslog IDs and the associated alert properties.

  2. Execute the report CSM_DISTRIBUTE_ALGLOBSYSLGFIL in CEN. You can do this manually using transaction SE38.

    Note

    If you change the table ALGLOBSYSLGFIL, you need to ensure that the above report is executed again so that the current configuration settings are active in the monitored systems. You can do this by scheduling the report CSM_DISTRIBUTE_ALGLOBSYSLGFIL as a job to be regularly executed. You can do this by defining a job (transaction SM36); more information: Job Scheduling.

Error Handling and Self-Monitoring

To check whether the desired settings are in effect in a monitored system, check the settings of the attribute group R3SyslogMcsDefaultCusGroup, which is assigned to all syslog messages in the monitoring infrastructure. You can do this as follows:

  1. Start the alert monitor by entering the transaction code RZ20.

  2. In the monitor set SAP CCMS Monitor Templates, start the Syslog monitor by double-clicking it.

  3. Expand the subtree for any instance, select any log attribute, and choose Properties.

  4. Switch to the Filter tab page. The table Revaluation of SAP System Log Messages on this tab page shows the configuration settings that you created in table ALGLOBSYSLGFIL.

If the desired settings are not in effect in one or more monitored systems, check whether report CSM_DISTRIBUTE_ALGLOBSYSLGFIL ran without errors:

  1. Start the alert monitor by entering the transaction code RZ20.

  2. In the monitor set SAP CCMS Technical Expert Monitors, start the monitor CCMS Selfmonitoring by double-clicking it, and expand the subtree Start of the navigation path <SysID> Next navigation step CCMS_Selfmonitoring Next navigation step Customizing Distribution (CEN) End of the navigation path.

  3. The Messages log attribute contains any error messages that occurred during the execution of the report.

More Information

Detailed information about central configuration of the monitoring of syslog messages: SAP Note 1303845.