Job Management Partner 1/Automatic Job Management System 3 System Design (Work Tasks) Guide

7.6.5 Notes on the Monitoring Event Log job

The following provides precautions (items you should know in advance) for using the Monitoring Event Log job.

Note

Windows Monitoring Event Log jobs are executed using the JP1/Base event log trapping function. Before executing such a job, start the JP1/Base event log trap service and the JP1/Base event service. If these services are not running, the job remains in Now monitoring or Now running status until the services start, and does not terminate even when an event occurs in the Windows event log. Also, which Windows events can be monitored depends on the JP1/Base event log trapping function. For details about this function, see the Job Management Partner 1/Base User's Guide.

The following figure gives an overview of the operation of the Monitoring Event Log job.

Figure 7-20 Overview of Monitoring Event Log job

Examples of jobnets that use the Monitoring Event Log job are as follows:

Execute a jobnet when a Windows event reporting the start of an application is output to the Windows event log.

Execute a jobnet when a Windows event reporting a successful authentication by the security system is output to the Windows event log.

When you define a Monitoring Event Log job, specify the type of log to be monitored, and the type of event. For the type of log to monitor, select system logs, security logs, application logs, DNS Server logs, Directory service logs, or File Replication Service logs. For the type of event, select information, warning, error, failed audit, and successful audit.

The event job ends and the condition is satisfied when the specified Windows event is output and data is acquired from the Windows event log.
Cautionary notes

When a Windows event cannot be placed in a category, "Others" appears in the Windows event viewer. However, if the event is converted to a JP1 event by using the JP1/Base event log trapping function, the category of the event will be "None". For this reason, when you define a Monitoring Event Log job, specify "None" rather than "Others" for Category. If you specify the string "Others", the monitoring condition will not be satisfied.

In its default state, the JP1/Base event log trapping function monitors Error and Warning events only. To monitor Information, Failure audit, and Success audit events, add the definitions for the events to be monitored to the operation definition file for JP1/Base event log trapping.

The monitoring condition is satisfied when the monitoring condition specified in Category of the Monitoring Event Log job completely matches the category of the Windows event. The maximum size of a monitoring condition is 255 bytes. However, the Windows event log might contain entries longer than 255 bytes. In this case, the system compares the character string specified in Category of the Monitoring Event Log job against the first 255 bytes of the category information of the Windows event, and the condition is satisfied if they match.

An item specified using a regular expression matches the condition if part of the specified character string matches. To require a full match, use a regular expression that explicitly specifies the full name. For information about the use of regular expressions in Windows, see the Job Management Partner 1/Base User's Guide.

When you specify a character string that includes a linefeed character in the Description definition item of the Monitoring Event Log job, the condition is satisfied if the character string before the linefeed character matches the monitoring condition, regardless of the character string following the linefeed character. To allow descriptions that contain linefeed characters to be monitored successfully, use regular expressions for the linefeed code, for example, use \n if the linefeed code is \n and use .*\n if the linefeed code is \r\n. For information about the use of regular expressions in Windows, see the Job Management Partner 1/Base User's Guide.
Example when the following character strings are monitored:
 
Starting TEST1...
Starting TEST2...
If the linefeed character after Starting TEST1 is \n, specify:

Starting TEST1\nStarting TEST2

If the linefeed character after Starting TEST1 is \r\n, specify:

Starting TEST1.*\nStarting TEST2

[Contents][Back][Next]

[Trademarks]