Unable to capture logmon command output with result that includes underscores "_"

Products

• DX Unified Infrastructure Management (Nimsoft / UIM)

Issue/Introduction

The logmon probe is deployed at DUxxxxxxxx030 with command: ksh /app/webservices/WAS_startup/WAS_mon.ksh, "Watcher Rules"  configured under "Match Expression" keyword “ERROR”. The result trigger is missing if the result contains "_". Please see sample below:

The result from UIM was unexpected: ERROR: APP= cdxxx NOT RUNNING...

The Actual result:

# ksh WAS_mon.ksh

ERROR: APP= cdxxx | PI_XXX | PI_ABCD | NOT RUNNING...

Expected result: ERROR: APP= cdxxx | PI_XXX | PI_ABCD | NOT RUNNING...

Environment

Release : 20.3

Component : UIM LOGMON

Cause

- logmon configuration

- command output format

Resolution

Try this simple regex for the Watcher, this worked when tested:

*ERROR*

If the output of the command is not being processed correctly it may be due to the format of the result. In that case, you can use logmon with this text black approach:

logmon - run command and generate one alarm that contains all output