Syslog Monitor
Use
You can use this monitor to monitor the system log for the various application servers of your system. The messages in the system log are grouped into subtrees linked by topic. The subtree in which an alert is reported depends on the category of the message. You can set these categories using the message ID in transaction SE92 (Maintain Syslog Message). You can also set the message text and the severity and criticality of the alert using this transaction. Note, however, that changes in this transaction are regarded as modifications and could therefore interfere with the import of a Support Package or a new SAP release. We therefore recommend that you make changes directly in the Alert Monitor (more information below).
Features
The various monitoring tree elements (MTEs) of the monitor correspond to the following categories that you can choose in transaction SE92:
MTE Name |
MTE Class |
Category in SE92 |
BasisSystem |
R3SyslogBasisSystem |
SAP Basis System |
Database |
R3SyslogDatabase |
Database |
CCMS |
R3SyslogCCMS |
Operation Trace |
Background |
R3SyslogBackground |
Background Processing |
Communication |
R3SyslogCommunication |
Communication |
Spool |
R3SyslogSpool |
Spool/Printing |
Security |
R3SyslogSecurity |
Security |
TransportSystem |
R3SyslogTransportSystem |
Transport |
BatchInput |
R3SyslogBatchInput |
Batch input |
Applications |
R3SyslogApplications |
Application |
Customer |
R3SyslogCustomer |
Customer Message |
Miscellaneous |
R3SyslogMiscellaneous |
No category assigned |
The SyslogFreq MTE (MTE class R3SyslogFreq) specifies the number of messages per minute that appeared in the system log of an application server.
Activities
To start the monitor, follow the procedure below:
...
1. Start the Alert Monitor using transaction RZ20 or choose CCMS ® Control/Monitoring ® Alert Monitor.
2. On the CCMS Monitor Sets screen, expand the SAP CCMS Monitor Templates set.
3. Start the Syslog monitor from the list by double-clicking it.
Changing the Alert Properties Locally in the Monitored System
You can also set the criticality and severity of an alert for a message directly in the Alert Monitor. In doing so, you overwrite the values that you entered in transaction SE92. To change the properties, follow the procedure below in the Syslog monitor:
...
1. Select an MTE for a category of system log messages of your choice, and choose Properties.
2.
The Monitoring: Properties and Methods screen appears. Choose
change mode with the Display « Change
(
) button.
3. Choose the Filter tab page. In the Revaluation of SAP System Log Messages group box, you can choose either Delete Line or Add New Lines.
4. You can now set the criticality (green, yellow, or red), and the Severity (0-255). You can do this both for a range of message IDs (From ID, To ID), and for individual message IDs (enter the same message ID for From ID and To ID).
5. Save your entries.
The message AB0 is to trigger a yellow alert and F20 a red alert with any severity. No other messages are to trigger alerts. You should therefore enter the following values in three lines:
From ID |
To ID |
Green |
Yellow |
Red |
A00 |
ZZZ |
X |
|
|
AB0 |
AB0 |
|
X |
|
F20 |
F20 |
|
|
X |
As the entries are processed from top to bottom, you must consider the sequence of the entries. In the above example, the message ID F20 is assigned a red alert, as the corresponding line is further down the list than the line in which F20 is assigned a green alert (F20 is contained in the range A00 to ZZZ).
Changing the Alert Properties in the Central Monitoring System (CEN)
The procedure described above is very time-consuming if you are monitoring large system landscapes centrally and want to set identical alert properties in a large number of monitored systems. You can therefore also set the filters described above in CEN and distribute them to the monitored systems. More information about this function: Centrally Configuring Monitoring of Syslog Messages.