Windows event log monitoring definition file (fluentd_@@trapname@@_wevt.conf.template)

Organization of this page

Format

<worker 0>
## [Metric Settings]
<source>
  @type exec
  command "echo {}"
  <parse>
    @type json
  </parse>
  run_interval 60s
  tag jpc_ima_metrics.wevt.log-monitoring-name
</source>
 
<filter jpc_ima_metrics.wevt.log-monitoring-name>
  @type record_transformer
  enable_ruby true
  auto_typecast false
  
  <record>
    __name__ fluentd_logtrap_running
    instance host-name
    jp1_pc_nodelabel IM-management-node-label-name
    jp1_pc_category category-ID
    jp1_pc_logtrap_defname log-monitoring-name_wevt
    jp1_pc_trendname fluentd
    job jpc_fluentd
    jp1_pc_nodelabel_fluentd Log trapper(Fluentd)
    jp1_pc_addon_program JPC Fluentd
  </record>
</filter>
</worker>
<worker worker-id>
## [Input Settings]
<source>
  @type windows_eventlog2
  tag wevt.log-monitoring-name
  channels log-type
  read_interval 2s
  <storage>
    @type local
    path ../data/fluentd/wevt/log-monitoring-name
    mode 0600
    dir_mode 0700
    pretty_print false
  </storage>
  read_existing_events false
  render_as_xml false
  rate_limit -1
  preserve_qualifiers_on_hash true
  read_all_channels false
  event_query *
</source>
 
## [Attributes Settings]
<filter wevt.log-monitoring-name>
  @type record_transformer
  enable_ruby true
  auto_typecast false
  renew_record false
  <record>
    ID event-ID
    JP1_SOURCEHOST host-name
    JPC_NODELABEL IM-management-node-label-name
    JP1_TRAP_NAME log-monitoring-name
#    OS_VERSION OS-version
  </record>
</filter>
 
## [Inclusion Settings]
#<filter wevt.log-monitoring-name>
#  @type grep
#  <regexp>
#    key attribute-name-of-JP1-event
#    pattern /regular-expressions-for-logs-to-monitor/
#  </regexp>
#</filter>
 
## [Exclusion Settings]
#<filter wevt.log-monitoring-name>
#  @type grep
#  <exclude>
#    key attribute-name-of-JP1-event
#    pattern /regular-expression-for-logs-not-to-monitor/
#  </exclude>
#</filter>
 
## [Forward Settings]
<match wevt.log-monitoring-name>
  @type rewrite_tag_filter
  <rule>
    key attribute-name-of-JP1-event
    pattern /regular-expression-for-logs-that-emit-JP1-events/
    tag ${tag}.jp1event
  </rule>
  <rule>
    key MESSAGE
    pattern /.+/
    tag ${tag}.outputlog
  </rule>
</match>
 
<filter /wevt\.log-monitoring-name\.(jp1event|outputlog)/>
  @type record_transformer
  enable_ruby true
  auto_typecast true
  renew_record true
  <record>
    eventId ${record['ID']}
    xsystem true
    message ${record['MESSAGE']}
    attrs ${record}
  </record>
  
  remove_keys $.attrs.ID
  remove_keys $.attrs.MESSAGE
</filter>
</worker>

To Page Top

File

fluentd_@@trapname@@_wevt.conf.template

fluentd_@@trapname@@_wevt.conf.template.model (model file)

To Page Top

Storage directory

■Integrated agent host

For a physical host (Definition file and model file)

Agent-path\conf\
For a logical host (Definition file)

shared-folder\jp1ima\conf\

To Page Top

Description

Definition file for monitoring Windows event logs.

Copy the template (fluentd_@@trapname@@_wevt.conf.template) and change file designation of Copy destination to fluentd_log-monitoring-name_wevt.conf to use it. For details on the location of fluentd_log-monitoring-name_wevt.conf, see Appendix A.4(3) Integrated agent host (Windows) and Appendix A.4(4) Integrated agent host (Linux) in the JP1/Integrated Management 3 - Manager Overview and System Design Guide. File name must be unique within the monitoring agent host. The characters that can be used for log-monitoring-name are alphanumeric characters, hyphens, and underscores, and the length of the character string is 1 to 30 characters. Create this file for each application you want to monitor.

JP1/IM - Agent creates a IM managed node for setup SID of monitoring target according to value specified in IM-management-node-label-name in the monitoring definition file. If IM-management-node-label-name is the same even if it is another monitoring definition file, only one IM management node is created.

Windows Event Log Monitor feature reads this File and analyzes the log information that the application has written to Windows Event Log. If conditions are specified for the analyzed information and the conditions are met, you can Setup the information to be converted to JP1 events or output to Fluentd logging File. For JP1 event to be issued, see 3.2.3(3) JP1 event to be issued by monitoring Windows event log.

Lines that begin with a "#" are treated as comments and do not affect programming behavior.

To Page Top

Character code

UTF-8 (without BOM)

To Page Top

Line feed code

In Windows: CR+LF

To Page Top

When the definitions are applied

This information is reflected in Fluentd operation when Fluentd service is restarted.

If add, delete of a definition file, or value in [Metric Settings] section is changed, the change is reflected in tree view of the Integrated Operation Viewer windows.

For details about application method, see 1.21.2(19) Creation and import of IM management node tree data (for Windows) (mandatory) in the JP1/Integrated Management 3 - Manager Configuration Guide.

To Page Top

Information that is specified

<worker> directive

Same as <worker> directive of Monitoring text-formatted log file definition file (fluentd_@@trapname@@_tail.conf.template).

worker-id (optional)

Description	Changeability	What You Setup in Your JP1/IM - Agent	JP1/IM - Agent Defaults Value
Same as `worker-id` of Monitoring text-formatted log file definition file (fluentd_@@trapname@@_tail.conf.template).	Can be changed	Same as `worker-id` of Monitoring text-formatted log file definition file (fluentd_@@trapname@@_tail.conf.template).	2

[Metric Settings] section

See the description of the [Metric Settings] section in Monitoring text-formatted log file definition file (fluentd_@@trapname@@_tail.conf.template).

[Input Settings] section

Specifies the event log type to monitor.

log-monitoring-name (mandatory)

Same as log-monitoring-name in the [Metric Settings] section of Monitoring text-formatted log file definition file (fluentd_@@trapname@@_tail.conf.template).

log-type (mandatory)

Specifies the event log type to be monitored as a comma-separated string. It is 256 bytes or less. The default value for JP1/IM - Agent is "application, system".

For details about the log type that can be specified, see 3.15.3(4)(a) Types of logs that can be monitored in the JP1/Integrated Management 3 - Manager Overview and System Design Guide.

[Attributes Settings] section

Setup attributes and attribute value of JP1 events to be issued.

log-monitoring-name (mandatory): Same as log-monitoring-name in the [Metric Settings] section of Monitoring text-formatted log file definition file (fluentd_@@trapname@@_tail.conf.template).
event-ID (optional): Same as the event ID in the [Attributes Settings] section of Monitoring text-formatted log file definition file (fluentd_@@trapname@@_tail.conf.template).
host-name (optional): Same as host-name in the [Attributes Settings] section of Monitoring text-formatted log file definition file (fluentd_@@trapname@@_tail.conf.template).
IM-management-node-label-name (optional): Same as IM-management-node-label-name in the [Attributes Settings] section of Monitoring text-formatted log file definition file (fluentd_@@trapname@@_tail.conf.template).
OS-version (optional): Specifies the number of the major version for Windows if you want JP1 event to add the attributes of OS_VERSION. In the default setup, "#" is specified at the beginning of the line, and it is handled as comment, so when specifying it, delete "#".

[Inclusion Settings] section

See the description of the [Inclusion Settings] section in Monitoring text-formatted log file definition file (fluentd_@@trapname@@_tail.conf.template).

[Exclusion Settings] section

See the description of the [Exclusion Settings] section in Monitoring text-formatted log file definition file (fluentd_@@trapname@@_tail.conf.template).

[Forward Settings] section

See the description of the [Forward Settings] section in Monitoring text-formatted log file definition file (fluentd_@@trapname@@_tail.conf.template).

To Page Top

Example definition

In the following example, monitoring is performed when the log type is "application" and the source is "JP1/IM-Manager", and a JP1 event is issued when the event level is "Warning" or higher.

<worker 0>
## [Metric Settings]
<source>
  @type exec
  command "echo {}"
  <parse>
    @type json
  </parse>
  run_interval 60s
  tag jpc_ima_metrics.wevt.user_app_log
</source>
 
<filter jpc_ima_metrics.wevt.user_app_log>
  @type record_transformer
  enable_ruby true
  
  <record>
    __name__ fluentd_logtrap_running
    instance hostA
    jp1_pc_nodelabel UserApplication
    jp1_pc_category applicationServer
    jp1_pc_logtrap_defname user_app_log_wevt
    jp1_pc_trendname fluentd
    job jpc_fluentd
    jp1_pc_nodelabel_fluentd Log trapper(Fluentd)
    jp1_pc_addon_program JPC Fluentd
  </record>
</filter>
</worker>
<worker 2>
 
## [Input Settings]
<source>
  @type windows_eventlog2
  tag wevt.user_app_log
  channels application
  read_interval 2
  preserve_qualifiers_on_hash true
  <storage>
    @type local
    path ../data/jp1ima/data/fluentd/wevt/user_app_log
  </storage>
  read_from_head false
  render_as_xml false
  rate_limit -1
  preserve_qualifiers_on_hash true
  event_query *
</source>
 
## [Attributes Settings]
<filter wevt.user_app_log>
  @type record_transformer
  enable_ruby true
  renew_record false
  <record>
    ID 00007602
    JP1_SOURCEHOST hostA
    JPC_NODELABEL UserApplication
    OS_VERSION 10
  </record>
</filter>
 
## [Inclusion Settings]
<filter wevt.user_app_log>
  @type grep
  <regexp>
    key PRODUCT_NAME
    pattern /JP1\/IM-M$/
  </regexp>
</filter>
 
## [Exclusion Settings]
#<filter wevt.user_app_log>
#  @type grep
#  <exclude>
#    key 
#    pattern //
#  </exclude>
#</filter>
 
## [Forward Settings]
<match wevt.user_app_log>
  @type rewrite_tag_filter
  <rule>
    key SEVERITY
    pattern /Warning|Error|Critical|Alert|Emergency/
    tag ${tag}.jp1event
  </rule>
  <rule>
    key SEVERITY
    pattern /.*/
    tag ${tag}.outputlog
  </rule>
</match>
 
<filter /wevt\.user_app_log\.(jp1event|outputlog)/>
  @type record_transformer
  enable_ruby true
  auto_typecast true
  renew_record true
  <record>
    eventId ${record['ID']}
    xsystem true
    message ${record['MESSAGE']}
    attrs ${record}
  </record>
  
  remove_keys $.attrs.ID
  remove_keys $.attrs.MESSAGE
</filter>
</worker>

To Page Top