UM:Log Monitoring - Revision history

AlexKirhenshtein: Text replacement - "^" to "{{deprecated}}"

2022-09-13T16:13:54Z

Text replacement - "^" to "{{deprecated}}"

← Older revision		Revision as of 16:13, 13 September 2022
Line 1:		Line 1:
	Information moved to documentation:		{{deprecated}}Information moved to documentation:

	https://www.netxms.org/documentation/adminguide/log-monitoring.html#log-monitoring		https://www.netxms.org/documentation/adminguide/log-monitoring.html#log-monitoring

TatjanaDubrovica: Replaced content with "Information moved to documentation: https://www.netxms.org/documentation/adminguide/log-monitoring.html#log-monitoring"

2017-11-24T15:03:34Z

Replaced content with "Information moved to documentation: https://www.netxms.org/documentation/adminguide/log-monitoring.html#log-monitoring"

Show changes

Victor: /* Tag */

2015-04-29T08:16:25Z

Tag

← Older revision		Revision as of 08:16, 29 April 2015
Line 190:		Line 190:
	\|-		\|-
	\| 16 \|\| Audit Failure		\| 16 \|\| Audit Failure
			\|-
			\| 256 \|\| Critical (since 2.0-M4 only on Windows 7/Windows Server 2008 and higher)
	\|}		\|}

Line 207:		Line 209:

	This tag has no effect for text log files, and can be used as a synonym for <nowiki><severity></nowiki> tag for syslog monitoring.		This tag has no effect for text log files, and can be used as a synonym for <nowiki><severity></nowiki> tag for syslog monitoring.


	=== <facility> Tag ===		=== <facility> Tag ===

Tomas Kirnak: Corrected capture group and minor grammar fixes

2015-04-24T12:34:41Z

Corrected capture group and minor grammar fixes

← Older revision		Revision as of 12:34, 24 April 2015
Line 418:		Line 418:
	= Passing parameters to events =		= Passing parameters to events =
	The log parser can send parameters to events.<br>		The log parser can send parameters to events.<br>
	Anything matched by the (.*) ~~expression~~ will be ~~send~~ to an event as a parameter.		Anything matched by the regular expression within () will be sent to the event as a parameter.

	Consider the following line is received via syslog, or added to a monitored file:		Consider the following line is received via syslog, or added to a monitored file:

Tomas Kirnak: Added "Passing parameters to events" section

2015-04-24T11:29:01Z

Added "Passing parameters to events" section

← Older revision		Revision as of 11:29, 24 April 2015
Line 414:		Line 414:
	</parser>		</parser>
	</syntaxhighlight>		</syntaxhighlight>


			= Passing parameters to events =
			The log parser can send parameters to events.<br>
			Anything matched by the (.*) expression will be send to an event as a parameter.

			Consider the following line is received via syslog, or added to a monitored file:
			<pre>
			24.04.2015 12:22:15 1 5 system,error,critical login failure for user testUser from 11.2.33.41 via ssh
			</pre>
			We can extract username and login method from the syslog message, and pass it as parameters to an event with the following rule:
			<pre>
			<match>system,error,critical login failure for user (.) from . via (.*)</match>
			<event params="2">10000</event>
			</pre>
			Username will be sent to the event as %1, IP address will not be sent, and login method will be sent as %2.

Macro: /* Examples of Parser Definition File */

2013-03-11T23:26:12Z

Examples of Parser Definition File

← Older revision		Revision as of 23:26, 11 March 2013
Line 399:		Line 399:
	2. Generate event with code 200000 if line in the log file '''C:\demo.log''' contains word '''process:''' and is immediatelly following line containing text '''process startup failed'''; everything after word '''process:''' will be sent as event's parameter.		2. Generate event with code 200000 if line in the log file '''C:\demo.log''' contains word '''process:''' and is immediatelly following line containing text '''process startup failed'''; everything after word '''process:''' will be sent as event's parameter.

	<syntaxhighlight lang="xml>		<syntaxhighlight lang="xml">
	<parser>		<parser>
	<file>C:\demo.log</file>		<file>C:\demo.log</file>

Macro: /* Tag */

2012-05-14T23:07:35Z

Tag

← Older revision		Revision as of 23:07, 14 May 2012
Line 113:		Line 113:

	=== <match> Tag ===		=== <match> Tag ===
	<nowiki>Tag <match> contains POSIX regular expression used to match log records. Parts enclosed in parenthesis can be extracted from log record and passed as arguments of generated event. You can use macros defined in <macros> section. Also, is is possible to define inverted match rules (rules when log </nowiki>record considered matching if it does not match regular expression). Inverted match can be set by setting attribute invert to 1.		<nowiki>Tag <match> contains a POSIX regular expression that is used to match log records. Parts enclosed in parenthesis can be extracted from log record and passed as arguments of generated event. You can use macros defined in <macros> section. Also, it is possible to define inverted match rules (rules when log </nowiki>record considered matching if it does not match regular expression). Inverted match can be set by setting attribute invert to 1.

	Some examples:		Some examples:
Line 121:		Line 121:
	</syntaxhighlight>		</syntaxhighlight>

	This regular expression will match any line ~~started~~ with word '''Error:''' , and everything after ~~that~~ word will be extracted from log record for use with event.		This regular expression will match any line starting with word '''Error:''', and everything after this word will be extracted from the log record for use with an event.


Line 129:		Line 129:

	This regular expression will match any line containing at least 3 consecutive digits.		This regular expression will match any line containing at least 3 consecutive digits.


	<syntaxhighlight lang="xml">		<syntaxhighlight lang="xml">
Line 136:		Line 135:

	This regular expression will match any line not containing character sequence '''abc'''.		This regular expression will match any line not containing character sequence '''abc'''.


	=== <id> Tag ===		=== <id> Tag ===

Macro: /* Matching rules */

2012-05-14T22:51:43Z

Matching rules

← Older revision		Revision as of 22:51, 14 May 2012
Line 109:		Line 109:
	\|}		\|}

	Inside the <nowiki><rule></nowiki> section are additional tags: <nowiki><match>, <description>, <event>, and <context></nowiki>. Only <nowiki><match></nowiki> section is mandatory – it specifies regular expression against which log record should be matched. All other tags are optional and ~~defines~~ parser behavior if record ~~match~~ regular expression.		Inside the <nowiki><rule></nowiki> section there are the following additional tags: <nowiki><match>, <description>, <event>, and <context></nowiki>. Only <nowiki><match></nowiki> section is mandatory – it specifies regular expression against which log record should be matched. All other tags are optional and define parser behavior if a record matches the regular expression.

Macro: /* Global Parser Options */

2012-05-14T22:49:29Z

Global Parser Options

← Older revision		Revision as of 22:49, 14 May 2012
Line 57:		Line 57:
	In the <nowiki><parser></nowiki> tag you can specify the following options:		In the <nowiki><parser></nowiki> tag you can specify the following options:

	{\| class="wikitable"		{\| class="wikitable" style="width: 70%"
	\|-		\|-
	! Option !! Description !! Default value		! Option !! Description !! Default value
Line 65:		Line 65:
	\| trace \|\| Trace level. \|\| 0		\| trace \|\| Trace level. \|\| 0
	\|}		\|}


	== <file> Tag ==		== <file> Tag ==

Macro: /* Matching rules */

2012-05-14T22:47:23Z

Matching rules

← Older revision		Revision as of 22:47, 14 May 2012
Line 101:		Line 101:
	In the <nowiki><rules></nowiki> section you define matching rules for log records. Each rule placed inside it's own <nowiki><rule></nowiki> tag. Each rule can have additional options:		In the <nowiki><rules></nowiki> section you define matching rules for log records. Each rule placed inside it's own <nowiki><rule></nowiki> tag. Each rule can have additional options:

	{\| class="wikitable"		{\| class="wikitable" style="width: 70%"
	\|-		\|-
	! Option !! Description !! Default value		! Option !! Description !! Default value
Line 384:		Line 384:

	Both '''action''' and '''reset''' attributes can be omitted; default value for '''action''' is '''set''', and default value for '''reset''' is '''auto'''.		Both '''action''' and '''reset''' attributes can be omitted; default value for '''action''' is '''set''', and default value for '''reset''' is '''auto'''.


	== Examples of Parser Definition File ==		== Examples of Parser Definition File ==