How to use logmon to run a command and generate one alarm that contains all output

Products

• DX Unified Infrastructure Management (Nimsoft / UIM)
• CA Unified Infrastructure Management SaaS (Nimsoft / UIM)
• Unified Infrastructure Management for Mainframe
• DX Unified Infrastructure Management (Nimsoft / UIM)

Issue/Introduction

Customer needs to run a command and have all of the output of the command returned in a single alarm message.

Environment

- UIM 8.51 or higher
- logmon v4.00 or higher

Cause

- logmon configuration

Resolution

Listed below are some screen shots and the portion of a logmon config showing a sample profile that will run a command and generate a single alarm with all of the output from the command. You should be able to adjust it to your specific requirements. Note that for the logmon text block variable you will have to define a field separator such as either:

• New line which is specified as /n
• White space (just press the space bar to enter it)
• Carriage Return which is \r
• etc… I used a space and it worked fine

Sample alarm output (multiple lines)

 

 

 

 

Additional Information

logmon.cfg sample

<TestBlockAlarmMessage>
      active = yes
      interval = 1 min
      scanfile = cmd /C netstat -an|findstr "4800"
      fileencoding =
      scanmode = command
      alarm = yes
      qos = yes
      message = no
      subject =
      user =
      reccur_directory = no
      reccur_directory_level = 10
      resetFile = no
      initialfileptr = 2
      resumefileptr = 4
      command_timeout_active = yes
      command_timeout = 20
      command_severity = 2
      command_timeout_alarm = yes
      alarmFOpenFail = no
      clearFOpenFailRestart = no
      monitor_exit_code = No
      max_alarm_sev = 5
      max_alarms =
      max_alarm_msg =
      password =
      <formats>
         <test>
            active = yes
            start = *TCP*
            end = *UDP*
            lines = 0
         </test>
      </formats>
      <watchers>
         <test1>
            active = yes
            match = /[0-9A-Za-z]+/
            level = warning
            subsystemid =
            message =
            i18n_token =
            restrict = test
            expect = yes
            abort = no
            sendclear = no
            count = no
            separator =
            suppid =
            source =
            target =
            qos =
            runcommandonmatch = no
            alarm_on_first_match = no
            commandexecutable =
            commandarguments =
            pattern_threshold_severity = information
            pattern_threshold_message =
            timeout = 1
            pattern_threshold =
            expect_message = ${netstatoutput}
            expect_level =
            regexfromexternalfile = no
            patternfilepath =
            token =
            variable_threshold =
            variable_threshold_message =
            variable_threshold_severity = information
            variable_threshold_supp =
            <variables>
               <netstatoutput>
                  definition = *
               </netstatoutput>
            </variables>
         </test1>
      </watchers>
   </TestBlockAlarmMessage>

Note that when you're running logmon on a Linux/Unix system, you MUST specify the absolute path to the command being run.

Testing Tips

 

Via Raw Configure for the logmon probe, you can set the debug parameter to 3 and logsize to 10000 so you can watch the progress. For example,

 

 

Note also that a 1-minute monitoring interval is useful for testing but can be too aggressive if the entire profile run takes longer than 1 minute due to the size of the output and/or overall processing time. A monitoring interval of 3 to 5 minutes is better for production monitoring but you can see how the probe handles it via the log output after 5 or so runs/passes.

 

If you have any trouble making this work using logmon v4.11, use the attached logmon-4.11-T3-20191224.075943-1_1646054502485.zip package which contains a few fixes.