Remote-monitoring log file-trap action definition file

Organization of this page

Format
File
Storage directory
Description
When the definitions are applied
Information that is specified
Example definition

Format

retry-times=number-of-retries
retry-interval=retry-interval
open-retry-times=number-of-retries
open-retry-interval=retry-interval
hold-count=number-of-held-JP1-events
keep-event={ OLD | NEW }
unset-extattr=attribute-suppressing-output
FILETYPE={ SEQ | SEQ2 | WRAP2 }
HEADLINE=number-of-header-lines
MARKSTR=[!]"regular-expression"
[!]"regular-expression-n"^#
ACTDEF=[{EXIT}][event-level][event-ID][!]"regular-expression"
[!]"regular-expression-n"^#

#: "regular-expression-n" indicates that multiple regular expressions are specified.

To Page Top

File

Use any file.

To Page Top

Storage directory

In Windows: Any folder
In UNIX: Any directory

To Page Top

Description

This file defines the actions for the remote monitoring log file trapping function. Its contents are referenced when the remote monitoring log file trapping function is started.

If you use UTF-8 as the encoding to save a file, save the file without attaching a BOM (byte order mark).

To Page Top

When the definitions are applied

The settings for the remote-monitoring log file-trap action definition file take effect at the following times:

When a reload or restart operation is performed from the Display/Edit Profiles window

For details about the Display/Edit Profiles window, see 5.9 Display/Edit Profiles window in the manual JP1/Integrated Management 2 - Manager GUI Reference.
When the jcfallogstart or jcfallogreload command is executed

For details about the jcfallogstart command, see jcfallogstart in Chapter 1. Commands. For details about the jcfallogreload command, see jcfallogreload in Chapter 1. Commands.
When JP1/IM - Manager is restarted

To Page Top

Information that is specified

retry-times

Specify a value from 0 to 86,400 for the number of retries to be attempted when a connection to an event service cannot be established due to a temporary communication failure. If this parameter is omitted, no retry operation is performed.

retry-interval

Specify a value from 1 to 600 (seconds) for the interval between retries to be performed when a connection to an event service cannot be established due to a communication failure. If this parameter is omitted, 10 seconds is assumed. This setting takes effect when the number of retries for connecting to an event service is set to one or a greater value. The retry interval is the interval between a failed attempt to connect to an event service and the next attempt. The time required for connection to an event service is not included. By combining retry-times and retry-interval, you can set a time equal to or longer than 24 hours, but if you do so and 24 hours or more passes after a retry attempt starts, retry processing stops.

open-retry-times

Specify a value from 1 to 3,600 as the number of retries to be performed if a log file cannot be read, or connection to the monitored host cannot be established. If this parameter is omitted, 1 is assumed. If the specified number of retries is exceeded, monitoring of the log file is stopped.

open-retry-interval

Specify a value from 3 to 600 (seconds) as the interval for retries to be performed if a log file cannot be read, or connection to the monitored host cannot be established. If this value is omitted, 3 (seconds) is assumed. The retry interval is the interval between the occurrence of an error and the next retry attempt.

hold-count

Specify a value from 1 to 100 as the number of JP1 events that can be held during retry processing. If this parameter is omitted, 100 is assumed. Executing a retry requires resources for holding JP1 events converted during retry processing. The amount of memory necessary for retry processing is as follows:

number-of-held-JP1-events × 1 KB

keep-event={ OLD | NEW }

When the number of JP1 events held during retry processing exceeds the limit, the excess JP1 events are removed. Use either of the values below to specify the type of events (old JP1 events or new JP1 events) to be kept when the number of held JP1 events exceeds the limit. If this parameter is omitted, OLD is assumed.

OLD: Specify this value if you want to keep old JP1 events. If this value is specified, values not exceeding the number of JP1 events specified in hold-count are held, and any JP1 events generated thereafter are removed.
NEW: Specify this value if you want to keep new JP1 events. If this value is specified and the set number of held JP1 events is exceeded, the JP1 events are removed starting from the oldest events.

unset-extattr

Specify this value when you do not want to output an attribute. You can set this value when the version of JP1/Base is 10-50 or later. If you do not want to output the monitoring name, specify TRAP_NAME. If you do not want to output the monitoring ID, specify TRAP_ID. If you do not want to output either of them, specify TRAP_NAME and TRAP_ID by separating them with a comma (,). The following is a specification example of when the monitoring name and monitoring ID are not output:

Example:: TRAP_NAME,TRAP_ID

This parameter must be written in a line.

FILETYPE={ SEQ | SEQ2 | WRAP2 }

Specify the data output format of the log file to trap. If this parameter is omitted, SEQ is assumed.

For details about the data output format of the log file to trap, see 7.6.3(1) Output formats of log file trap information in the JP1/Integrated Management 2 - Manager Overview and System Design Guide.

HEADLINE

Specify a value from 0 to 99,999 as the number of header lines when there is a header at the beginning of the log file to be read. If this parameter is omitted, it is assumed that there is no header.

Note that if the size of a character string in the specified header exceeds the upper limit for header size (10 kilobytes), an error occurs.

MARKSTR=[!]"regular-expression"

Specifies, using regular expressions, data that you do not want to monitor, such as data that is not log data. If this parameter is omitted, it is assumed that no data is excluded as data to be monitored. Enclose a regular expression in double-quotation marks ("). Data that is not log data refers to data that is output to a log file at a certain interval. The following are examples.

Example:: "==== 13:00:00 JP1/Base Event ===="

If an exclamation mark (!) is inserted before a double-quotation mark ("), the regular expression becomes an exclusion-condition and any data not matching the specified regular expression is not monitored.

You can specify multiple regular expressions for a single MARKSTR parameter. If multiple regular expressions are specified, the AND condition is applied. Therefore, the only data that is not subject to monitoring is the data that matches all the regular expression conditions, including the specification of the exclamation mark (!). Separate multiple regular expressions by a linefeed. On line 2 and subsequent lines, specify only values, and type at least one space before a value on each of the lines. The following example shows how to specify data that contains ==== and MARK as data that is not to be monitored:

Example:

MARKSTR="====" (linefeed)

Δ Δ Δ Δ Δ "MARK"

Legend: Δ indicates a single-byte space.

This parameter can be specified multiple times. You can specify this parameter as many times as you wish. When multiple parameters are specified, the OR condition is applied, and any data that matches any specification is not monitored.

A regular expression specified for this parameter is checked from the beginning of the entered log data to the length specified by the -m option of the jevlogstart command. If this parameter is omitted, it is assumed that all data is log data.

ACTDEF=[{EXIT}][event-level][event-ID][!]"regular-expression"

Specifies a regular expression for the log data to be converted to JP1 events, event IDs corresponding to those JP1 events, and event levels. If this parameter is omitted, it is assumed that none of the above values are specified. If there is log data that matches the regular expression, a JP1 event is issued with the specified event ID. Do not use a space or a tab before or after =, EXIT, event-level, or event-ID. If you do so, a syntax error occurs.

EXIT

If multiple ACTDEF parameters are specified and log data matches a condition specified for EXIT, monitoring of the log data ends.

If multiple ACTDEF parameters are specified and one log data item matches multiple ACTDEF parameter conditions, JP1 events equal to the number of matched conditions are issued. If EXIT is specified, a JP1 event is issued with the event ID of the condition specified for EXIT, after which no more log data is monitored.

event-level

Specify the event level for the extended attribute of a JP1 event by enclosing it in left and right angle brackets (< and >). You can specify the following values:

Emergency

Alert

Critical

Error

Warning

Notice

Information

Debug

If this parameter is omitted, Notice is assumed.

event-ID

Specify an event ID for registering a JP1 event on an event server. Separate the first four bytes (basic code) and the last four bytes (extended code) of the event ID by a colon (:), and write the ID in hexadecimal notation. Use uppercase A to F. Note that the last four bytes (the four bytes after the colon) can be omitted, in which case 0 is assumed for the omitted value. Zeros (0) are also inserted for any non-specified digits, beginning on the left side, if either the first or last four bytes have fewer than eight digits. Use a user-specifiable value from 0:0 to 1FFF:0 and 7FFF8000:0 to 7FFFFFFF:0. For an extended code, specify 0. Event ID format examples are provided below.

Example:

The following three specifications have the same meaning:

0000011A:00000000

11A:0

11A

"regular-expression"

Specify the log data to be converted to a JP1 event in a regular expression. The regular expression you can use is fixed to the extended normal expression. Enclose a regular expression in double-quotation marks ("). If an exclamation mark (!) is inserted before the first double-quotation mark ("), the regular expression becomes an exclusion-condition and any data that does not match the specified regular expression is converted.

You can specify multiple regular expressions for a single ACTDEF parameter. If multiple regular expressions are specified, the AND condition is applied. Therefore, only data that matches all the regular expression conditions, including specification of the exclamation mark (!), is converted to JP1 events. Separate multiple regular expressions by a linefeed. On line 2 and subsequent lines, specify only values, and type at least one space before a value on each of the lines. The following example shows how to specify data that contains jp1base and error as data to be converted to the JP1 event with event ID 00000333:

Example:

ACTDEF=00000333 "jp1base" (linefeed)

Δ Δ Δ Δ Δ"error"

Legend: Δ indicates a single-byte space.

More than one of this parameter can be specified. You can specify this parameter as many times as you wish. When multiple parameters are specified, the OR condition is applied, and any data that matches a specification is converted to JP1 events.

A regular expression specified for this parameter is checked from the beginning of the entered log data to the length specified as the maximum length of data converted to an event for a startup option (bytes).

This parameter cannot be omitted.

To Page Top

Example definition

Example definition for the MARKSTR and ACTDEF parameters

The following examples show example definitions for the MARKSTR and ACTDEF parameters based on the following log data.

[Figure]

Example definition 1

The log file trap conditions are listed on the left, and the example definition for the log file-trap action definition file is shown on the right.

[Figure]

Example definition 2

Log file trap conditions that are different from the conditions listed for example definition 1 are listed on the left, and the example definition for the log file-trap action definition file is shown on the right.

[Figure]

To Page Top