Log File Monitoring Data Provider 
To monitor more log files in the monitoring and alerting infrastructure than the default settings delivered by SAP. You have created a template in the SAP Solution Manager Configuration (see Create, Assign and Activate a Customer Template) and are creating a metric (see Creating a Metric).
This section contains information about which log file monitoring data providers SAP provides, which of these data providers you can use for which files, and which input parameters you need to set to create metrics.
Structure
SAP delivers various log file monitoring data providers, in the data collector Diagnostic Agent (Push). To create a metric, enter one of these data providers in the Data Collection tab, depending on the type of files you want to monitor in which way.
Each data provider has input parameters with which you can specify the files to be monitored, their paths, and the search pattern. You can display a description of the data provider and its input parameters, in the Data Collection tab, by choosing Note next to the data provider name.
Note
The input parameters to specify the path and names of the files to be monitored contain variables, to which you give values at run time, such as the system ID of the managed system, instance ID and instance name. This makes the input parameters independent of the managed object.
If you want to monitor, for example, the size of log files in the work directory of an ABAP instance, using the data provider File Information (see below), enter, in the input parameter FOLDER, the value \Q$INSTANCE_FULL_PATH$/work\E. \Q and \E delimit the parameter value, and $INSTANCE_FULL_PATH$ is the variable name (in this case the complete path of the instance), which is replaced by the actual value at run time.
Here is a selection of variable names which you could use for path and file names:
Variable name | Example |
|---|---|
$INSTANCE_DESC$ | ld8200_EE1_00 |
$INSTANCE_NAME$ | DVEBMGS00 |
$INSTANCE_NUMBER$ | 00 |
$INSTANCE_FULL_PATH$ | /usr/sap/EE1/DVEBMGS00/ |
$HOST_FULL_NAME$ | vml2457.wdf.sap.corp |
$HOST_NAME$ | vml2457 |
$T_SYSTEM_SID$ | EE1 |
SAP delivers the following log file monitoring data providers, in the data collector Diagnostic Agent (Push):
Monitoring of standard Java log files with the data provider “Log File Monitor”
Standard Java log files of SAP systems are monitored by the agent sapstartsrv, which is automatically installed with any ABAP or Java instance. The data provider Log File Monitor uses this agent to read the log files. The data provider returns the number of hits according to the input parameters.
Two conditions must be fulfilled to monitor a log file with this data provider:
The log file must have been registered when the agent sapstartsrv was installed.
To determine which log files are registered for the agent, call the SAP Management Console (SAP MC) for a managed system, and expand the instances in the navigation bar. The files in the node Log Files are registered with the agent.
The log file must be in SAP Log Format or GenericLogFormat. These files can also be displayed in HTML format in SAP MC, other files can only be displayed in text format (the format of these files, which you cannot monitor with this data provider, is Text in the SAP MC log file list).
Example
The data provider is used for the delivered metric group Number of Errors in Java Standard Trace. This metric is is in all SAP System Monitoring templates for the managed object type 
Technical Instance 
SAP J2EE <all releases> 
.
The data provider Log File Monitor has the following input parameters. Specify which entries of which log files are to be monitored by a metric:
Parameter ID | Parameter Name | Optional/Obligatory | Meaning |
|---|---|---|---|
FILENAME | File Name | Obligatory | File name of the log file to be monitored, including the relative path as expected by SAP Control. Regular expressions are supported, e.g.: j2ee/cluster/server[0-9]{1,2}/log/defaultTrace*.trc |
FILTER_TEXT | Log File Text Filter | Optional | Text to be searched for. The filter expression must be a regular expression. |
SEVERITY | Log File: Minimum Severity | Optional | Minimum severity of the log entry. Possible values are the SAP severities: Fatal, Error, Warning, Info, Path, Debug. |
APPLICATION | Application | Optional | Filters for the Java application, placeholder (*, ?) are supported. Use the prefix \Q and suffix \E for the filter expression, e.g. \Q*sap.com/tc~wd~dispwda*\E. |
LOCATION | Location | Optional | Filters for the Java location, placeholder (*, ?) are supported. Use the prefix \Q and suffix \E for the filter expression, e.g. \Q*com.sap.engine.services.servlets_jsp.Deploy*\E. |
Monitoring of SAP standard log files (except ABAP and Java) with the data provider “Log File Monitor for SAP Host”
Any host, on which any SAP applications run, is monitored by the agent saphostagent, which is installed automatically when the application is installed (see Monitoring Hosts with SAPHostControl and saphostexec). The data provider Log File Monitor for SAP Host uses this agent to read the log files. The data provider returns the number of hits according to the input parameters.
The data provider has three of the input parameters FILENAME, FILTER_TEXT and SEVERITY, of the data provider Log File Monitor, described above, with which you can specify which files are to be monitored for which entries. You can use the data provider Log File Monitor for SAP Host to monitor log files in SAP Log Format which are not registered at the instance agent sapstartsrv.
You can specify the type of log files to monitor, i.e. the file format for the data provider. It has the following two input parameters:
Parameter ID | Parameter Name | Optional/Obligatory | Meaning |
|---|---|---|---|
TRANSFORMERCLASS | Transformer Class | Optional | This parameter specifies the log file format. The possible parameter values are described in detail in the data provider description. |
METADATA_ID | Metadata ID | Optional | If you specified com.sap.smd.agent.log.generic.GenericLogReaderFactory as transformer class (and only then), you must also specify which application wrote the log file, so that the data provider can interpret the data in the log file correctly. The possible parameter values are described in detail in the data provider description. |
Example
The data provider is used for the delivered metric group BOE BI Workspace Server Critical Exceptions Status. This metric is in all SAP System Monitoring templates for the managed object type Technical Instance T BOE BI Workspace Service .
Monitoring the ABAP system log with the data provider “ABAP Read SysLog”
This data provider monitors selected entries in the ABAP system log (see System Log). Specify the messages to be monitored in MAI, with their 3-digit ID. This ID comprises the area code (2 characters) and the sub-name (1 character). By default, this data provider already monitors the following system log messages. There is a metric with the number of corresponding messages, for each of these messages. The data provider returns the number of messages.
Area code | Subname | Message Short Text |
|---|---|---|
BV | 4 | Work process is in status Reconnect |
BY | 2 | Database error &6 in &7 |
BY | 4 | Database error &6 in &3 access to table &5&5 |
BY | M | SQL error &6. Work process is in status Reconnect |
ED | 4 | Name of this SAP system not found |
FB | N | Spooler full |
AB | 1 | > Short dump "&6 &6 &8&8&8&8 &6&6" created. |
To monitor other system log messages yourself, create a variant for the metric group Number of Special ABAP System Log Messages (this group is under Technical Instance <ABAP release> in the category Exception), by selecting the metric group in your customer template, and, in the Data Collection tab, choosing Add Variant.
Enter the following parameter values in the metric group variant table:
Parameter ID | Parameter Name | Optional/Obligatory | Meaning |
|---|---|---|---|
MESSAGE_NO | Message ID | Optional | Three-character message ID to be searched for |
MESSAGE_SEVERITY | Message Severity | Optional | Severity of the log entry. Possible values are the SAP severities for ABAP: SAPControl-RED, SAPControl-YELLOW and SAPControl-GREEN. |
MESSAGE_TEXT | Message Text | Optional | Text to be searched for. The filter expression must be a regular expression. |
Monitor general file attributes with the data provider “File Information”
The data provider File Information monitors the general information about any files. Specify a file name pattern. You get information about how many files have this name pattern, their file size, and which file with this name pattern was last or first changed. This is general file information, not file contents, as for other data providers.
Note
The functions are partly based on the SAP Management Agents monitoring functions (see Central File Monitoring).
The data provider File Information has the following input parameters. Specify which key figures of which files are to be monitored:
Parameter ID | Parameter Name | Optional/Obligatory | Meaning |
|---|---|---|---|
FOLDER | Absolute path of monitored folder | Obligatory | Absolute, full path to the folder which contains the monitored files. This parameter does not allow wildcards(*, ?).
You often need variables here. There are examples of available variables above, in this section. End of the note. |
FILEPATTERN | File Pattern | Obligatory | Name pattern of the files to be monitored. Regular expressions are supported |
KEY_FIG | Key Figure | Obligatory | File attribute to be returned. Possible values are:
|
RECURSIVE | Whether subfolders are also to be checked | Optional | Parameter which specifies whether subfolders are also to be checked for the name pattern. Default value False. |
The Diagnostic Agent must be authorized to read the files to be monitored. The agent runs under the user <SystemID>adm (Unix) or SAPService<SystemID> (Windows).
Example
The data provider is used for the delivered metric groups File age, File size and Number of files. This metric is in SAP System Monitoring templates for the managed object type Host (Server) <all operating systems> . The metric groups are delivered inactive and with no variants. To create metrics, create a variant for the metric group by selecting the metric group in your template, and, in the Data Collection tab, choosing Add Variant.
Monitor text files with the data provider “File Text Pattern Search”
The data provider File Text Pattern Search monitors text files for text patterns, and returns the number of hits for this text pattern in the file. Use this data provider if the file whose contents you want to monitor has a format which the data provider above cannot monitor. This is, for example, the case for ABAP log files outside the system log.
Note
The functions are partly based on the SAP Management Agents monitoring functions (see Central File Monitoring).
The data provider File Text Pattern Search has the following input parameters. Specify which text patterns in which files are to be monitored:
Parameter ID | Parameter Name | Optional/Obligatory | Meaning |
|---|---|---|---|
FOLDER | Absolute path of monitored folder | Obligatory | Absolute, full path to the folder which contains the monitored files. This parameter does not allow wildcards(*, ?).
You often need variables here. There are examples of available variables above, in this section. End of the note. |
FILEPATTERN | File Pattern | Obligatory | Name pattern of the files to be monitored. Regular expressions are supported |
SEARCHPATTERN | Search Pattern | Obligatory | Text pattern to be searched for. Regular expressions are supported |
DELTA_READ | Delta Read Access | Obligatory | Whether each read reads the file from the beginning, or only the rows which have been added by the data provider since the last read:
|
Example
The data provider is used for the delivered metric group Text Pattern Search. This metric is in SAP System Monitoring templates for the managed object type Host (Server) <all operating systems> . The metric group is delivered inactive and with no variants. To create metrics, create a variant for the metric group by selecting the metric group in your template, and, in the Data Collection tab, choosing Add Variant.
The template for the Technical Instance SAP MDM Server , contains an example of actively delivered metrics provided by this data provider. The category Exceptions contains various metrics which output the number of errors (identified by the key figure 25 or 26 in the file) in various log files.
Monitoring Windows event logs with the data provider “Windows Event Log Monitor”
Use the data provider Windows Event Log Monitor to monitor the Windows event log in Windows platforms. By default, the event log logs events in the following areas:
Security
This log contains security-relevant events, such as file accesses and changes, or successful and failed logons. Specify the events to be logged, in the security settings.
Applications
This log contains events which were written by an application or a program. The application developer decides which events are to be logged.
System
This log contains events reported by Windows system components.
The data provider returns the number of hits in the event log. Specify which event logs and sources are to be monitored, in the data provider input parameters:
Parameter ID | Parameter Name | Optional/Obligatory | Meaning |
|---|---|---|---|
LOGNAME | Event Log Name | Obligatory | Name of the event log to be monitored. Possible values are Application, System, Security |
SEARCHPATTERN | Search Pattern | Optional | You can filter the number of messages found by a text pattern which is searched for in the messages. Regular expressions are supported. |
SEVERITY | Minimum severity level of event log entry | Optional | You can filter the number of messages found by a minimum severity level. The following severity levels are allowed: Critical, Error, Warning, Information, Detailed. |
SOURCE | Event Source | Optional | You can filter the number of messages found by event sources to be monitored (usually the applications which write into the event log). |
EVENTID | Event Log Event ID | Optional | Messages in the event log have an event ID. If only specific messages are to be monitored, specify the event IDs, as a list separated by commas. |
Monitoring Sybase log files with the data provider “Log File Monitor Sybase Logs”
Use the data provider Log File Monitor Sybase Logs to monitor logs from the Sybase Unwired Platform (SUP) database. The monitoring is performed technically by the agent saphostagent, which reads the log files. The data provider returns the number of hits according to the following input parameters.
Parameter ID | Parameter Name | Optional/Obligatory | Meaning |
|---|---|---|---|
FILENAME | File Name | Obligatory | File name of the log file to be monitored, including the relative path as expected by SAP Control. Regular expressions are supported. |
HOSTNAME | Host Name | Obligatory | Name of the host on which the log files are to be monitored. Use the variable $HOST_NAME$, which is replaced by the relevant value at run time |
LONGSID | External System ID | Obligatory | External system ID. Use the variable $T_SYSTEM_LONG_SID$, which is replaced by the relevant value at run time |
FILTER_TEXT | Log File Text Filter | Optional | Text to be searched for. The filter expression must be a regular expression |
SEVERITY | Log File: Minimum Severity | Optional | Minimum severity of the log entry. Possible values are the SAP severities: Fatal, Error, Warning, Info, Path, Debug. |
DOMAIN | Domain Name | Optional | Name of the domain to which the log files to be monitored should be assigned. |
Example
The data provider is used for the metric Number of Exceptions in Default Domain Log for the Type of managed objects Technical Instance Sybase Unwired Server .
Example
There is an example of monitoring additional log files, from the creation of a customer template the creation of metrics and alerts, to data display in technical monitoring, under Log File Monitoring Example.