7.6.1 Collecting log information

Linking with IM Configuration Management functions and JP1/Base log file trapping, authentication management for remote monitoring and the remote monitoring log file trap function collect remote monitoring log information from SSH, WMI, and NetBIOS (NetBIOS over TCP/IP) on remotely monitored hosts.

The following figure shows the relationships between the functions for collecting remote monitoring log information.

Figure 7‒43: Relationships between the functions for collecting remote monitoring log information

Remote monitoring log information collection is done based on the character string for the start option or monitoring conditions for action definition that are set on the IM configuration management viewer or on a command for remote monitoring. To collect remote monitoring log information, the manager connects to the remotely monitored hosts, collects the output results of the log files or event logs at the specified monitoring interval, and passes the information to the JP1/Base log file traps.

For the character string for the start option, the contents set in the IM configuration management viewer or in the start option of a command, and the contents set in the remote-monitoring log file trap startup-definition file or the remote-monitoring event log trap action-definition file are used. For the action definition, the contents set in the remote-monitoring log file trap action-definition file and in the remote-monitoring event log trap action-definition file are used.

To use the remote-monitoring log file trap function, specify a log file trap name. A remote-monitoring log file trap name can be the same as the name for a remote-monitoring log file trap on another monitored host or for a JP1/Base log file trap. However, the same name cannot be specified for multiple remote-monitoring log file traps on one monitored host. Specify a unique name for a monitored host.

Note: When the remote event-log trapping function is used, the monitoring name DEFAULT0 is used internally by the JP1/Base log file trapping function. Therefore, the name DEFAULT0 is output by the JP1/Base log file trapping function to the log message. However, DEFAULT0 is not set as a monitoring name for the JP1 event extended attribute. If a monitoring name is specified for trap-name in the filter parameter in the remote-monitoring event log trap action-definition file, the value specified for trap-name is set as the monitoring name for the JP1 event extended attribute.

The following figure shows how remote monitoring log information is collected.

Figure 7‒44: Collecting remote monitoring log information

The following describes the above figure.

Use JP1/IM - View or a command for remote monitoring to set a predefined filter.

For details about predefined filters, see 7.6.5 Predefined filter.
Use JP1/IM - View or a command for remote monitoring to set the character string for the start option and monitoring conditions for action definitions.
Connect to the remotely monitored hosts at each monitoring interval set for monitoring conditions.
Collect the newly acquired log information from the remotely monitored hosts.
Pass the collected information to the JP1/Base log file trap.
Register the log information items that match the monitoring conditions as JP1 events in the event database.

Before performing remote monitoring, remote communication must be set up between the manager and the monitored hosts. For details about the communication settings, see 1.17 Specifying settings for monitoring logs on remotely monitored hosts (for Windows) (for Windows) or 2.16 Specifying settings for monitoring logs on remotely monitored hosts (for UNIX) (for UNIX) in the JP1/Integrated Management 2 - Manager Configuration Guide. For details about how to configure the settings for collecting remote monitoring log information, see Chapter 3. Using IM Configuration Management to Set the System Hierarchy in the JP1/Integrated Management 2 - Manager Configuration Guide.

To Page Top