We would like to configure the logmon probe with a basic command profile to count the number of files and folders in a directory:
ls -1 <directory> | wc -l
If over 90,000, send a critical alarm
How can we achieve this?
Release : 20.1
Component : UIM LOGMON
For the Watcher just put an asterisk to match everything that the command returns, e.g.:
Go into the 'variables' tab and set up a variable which matches on "Match Expression" as follows-
"expected value" means that we send an alarm if the value doesn't fall within this range. So if we're sending an alarm on >90,000 the expected value is <90,000.
Finally, in the "alarm" tab set 'Minimum Match Count' to 1 here - this is where you tell it to send an alarm if the aforementioned expected value is out of range and how many times it has to be out of range before we send an alarm. In this case we want to send an alarm immediately in response to the command so we set this to "1" and then you can fill in whatever you want for the message. (otherwise it will give a generic "variable threshold exceeded" message).