11.1.3 Notes on log file trapping

Stop the log file trap before you edit or delete a log file that is being monitored by log file trapping. If you attempt to edit or delete a log file while the trap is in progress, the monitoring position in the file might change and the trap will fail to convert the data correctly.
The log file trapping function cannot extract data written to a log file unless the data has actually been written to a disk. This means that sometimes you might not be able to retrieve log messages as soon as they occur because the data has not been written to a disk yet.
It will take a long time for the first JP1 event to be generated if the log write-position is near the end of the file.

Organization of this subsection

(1) Notes on monitoring the integrated trace log or syslog file
(2) Note on using JP1/AJS log file monitoring jobs
(3) Note on monitoring Unicode files in Windows
(4) Monitoring syslog files in SUSE Linux 15 or later

(1) Notes on monitoring the integrated trace log or syslog file

The event server settings file (conf) includes the options parameter with KAJP1037-syslogoff and KAJP1037-hntroff by default when JP1/Base V12 is newly installed. However, the parameter is not set properly in the following cases: you restore the definition file from another version where these flags are not set, you install JP1/Base by overwriting another version where these flags are not set, or you delete these flags. When KAJP1037-syslogoff and KAJP1037-hntroff are not specified and you use a log file trap to monitor the integrated trace log or syslog file, attempts to transfer events might fail repeatedly. In such a case, the transfer error message KAJP1037-E is output to the integrated trace log or syslog file. If you include settings like the following in the action definition file for log file traps in order to monitor the integrated trace log or syslog file, the transfer error message KAJP1037-E is converted to a JP1 event.

Setting example:

When monitoring the integrated trace log or syslog file:

ACTDEF=<Error>11 "KAJP....-E"
ACTDEF=<Error>11 "-E"

When monitoring the syslog file:

ACTDEF=<Error>11 "error"

In this case, if the forwarding settings file (forward) is used with initial settings in a system that links with IM Configuration Management of JP1/IM or that uses the JP1/Base configuration management functionality, transfer-failure JP1 events are also forwarded. This causes the event transfer to loop repeatedly.

To prevent the event transfer from looping, change the setting in the action definition file for log file trapping, so that a log file trap will not trap the KAJP1037-E message. A setting example is shown below.

Setting example 1:

MARKSTR="KAJP1037-E"

Setting example 2:

ACTDEF=<Error>11 "KAJP....-E"
       !"KAJP1037-E"

To Page Top

(2) Note on using JP1/AJS log file monitoring jobs

If you want to use a JP1/AJS log file monitoring job, you must first start the JP1/Base log-file trap management service (daemon) and the event service. JP1/AJS log file monitoring jobs are executed using the JP1/Base log file trapping function.

For details on log file monitoring jobs, see the JP1/Automatic Job Management System 3 System Design (Configuration) Guide, JP1/Automatic Job Management System 3 System Design (Work Tasks) Guide, and the JP1/Automatic Job Management System 3 Administration Guide.

To Page Top

(3) Note on monitoring Unicode files in Windows

When you use a log file trap to monitor Unicode files in Windows, even if the log file trap is started successfully, the log files might not be monitored properly. These problems occur due to inappropriate action definition specification or erroneous monitoring target files.

When you monitor Unicode files in Windows, errors are not reported in the cases shown in the table below. Therefore, check the log file trap operation (whether filtering can be properly performed according to the condition) in advance.

Table 11‒1: Cases where Unicode files cannot be monitored properly in Windows and associated prior checks
Case where monitoring cannot be performed properly	Prior check
Basic regular expression is used in the `MARKSTR` and `ACTDEF` parameters in the action definition file for log file trapping.	Specify the extended regular expressions used in the operation to the `ACTDEF` parameter in the action definition file for log file trapping, and check if proper filtering is performed according to the condition.
A Unicode file is specified in the action definition file for log file trapping.	Specify a multi-byte character in the `ACTDEF` parameter in the action definition file for log file trapping, and check if proper filtering is performed according to the condition.
The monitoring target file is a Unicode file and the `-g` option is omitted when executing the `jevlogstart` command.
You used the `jevlogstart` command with the `-g` option intending to monitor a Unicode file, but mistakenly specified a log file that is not Unicode.

To Page Top

(4) Monitoring syslog files in SUSE Linux 15 or later

In SUSE Linux 15 or later, by default, log information is output to journals only, not to syslog.

To monitor syslog files by using log file traps, syslog output must be enabled. For details about how to enable syslog output, see 3.4.8 Syslog output when SUSE Linux 15 or later.

To Page Top