7.6.8 Monitoring logs that are generated while remote monitoring is stopped
The remote monitoring function enables you to collect logs that are generated while remote monitoring is stopped by saving the location of collected logs and then restoring the previous collection status when remote monitoring is restarted.
|
|
![[Figure]](GRAPHICS/CF075000.GIF)
If remote monitoring is stopped and then restarted, this function executes Collection (3) shown in the figure when the function's processing starts. Collection (3) involves collection of logs that occurred from Collection (B) to Collection (C).
The previous collection status can be inherited when remote monitoring is restarted by using remote-monitoring log file traps and remote-monitoring event log traps. When the collection status of remote-monitoring log file traps is inherited, the function collects logs starting at the line that immediately follows the last line collected. When the collection status of remote-monitoring event log traps is inherited, the function collects logs that are generated subsequent to the time of the last event log that was collected.
You specify whether to monitor logs that are generated while remote monitoring is stopped with the START_OPTION parameter in the remote log trap environment definition file (jp1cf_remote_logtrap.conf). For details about the remote log trap environment definition file (jp1cf_remote_logtrap.conf), see Remote log trap environment definition file (jp1cf_remote_logtrap.conf) (Chapter 2. Definition Files) in the manual JP1/Integrated Management 2 - Manager Command, Definition File and API Reference.
- Organization of this subsection
(1) Notes
The remote-monitoring function might not be able to inherit the collection status depending on the operations performed with IM Configuration Management between the time remote monitoring was stopped and the time remote monitoring is restarted.
- Cases where the collection status cannot be inherited (for remote-monitoring log file traps)
-
-
Settings for the monitored log file names were added or changed since the last time remote monitoring was stopped.#1
-
A profile was deleted and then another profile was created with the same name.
-
Monitored hosts were removed from the remote monitoring configuration and then were added back again to the remote monitoring configuration.
-
When host information for the monitored hosts was collected, the OS names for the monitored hosts had changed.
-
When remote monitoring settings were changed for the monitored hosts, the communication type (WMI/NetBIOS, SSH) was changed.
-
Monitored hosts were removed from the host list in IM Configuration Management and were then added to the list again.
-
While log files with log file format SEQ, SEQ2, or WRAP2 were being monitored, a KNAN26095-E error message was output and remote monitoring was stopped.#2
#1: The file names are case sensitive.
#2: For details about the errors, see 2.13 Messages related to IM Configuration Management (KNAN22000 to KNAN26999) in the manual JP1/Integrated Management 2 - Manager Messages.
-
- Cases where the collection status cannot be inherited (for remote-monitoring event log traps)
-
-
Monitored hosts were removed from the remote monitoring configuration and then were added back to the remote monitoring configuration.
-
When host information for the monitored hosts was collected, the OS names for the monitored hosts had changed.
-
Monitored hosts were removed from the host list in IM Configuration Management and were then added to the list again.
-
When you want to edit or delete the log file being monitored with a remote-monitoring log file trap, stop the remote-monitoring log file trap. Editing or deleting the log file while the remote-monitoring log file trap is running can cause the monitoring position of the log file to become misaligned, which in turn can prevent information from being correctly converted.