How to Identify What Strings Trigger Alerts on Logmon Profiles

Products

• DX Unified Infrastructure Management (Nimsoft / UIM)

Issue/Introduction

Support teams or administrators may need to audit existing logmon profiles to identify the specific text patterns, keywords, or regular expressions (regex) that are configured to trigger alarms.

Environment

DX UIM 20.4 / 23.4
logmon probe (any version)

Resolution

Alerting logic in the logmon probe is defined at the Watcher level. Follow these steps to identify the triggering strings:

Method 1: Using the Probe GUI (Admin Console or Infrastructure Manager)

1. Open the logmon probe configuration.
2. Navigate to the Profiles list and select the profile you wish to audit.
3. Click on the Watcher Rules tab. This tab lists all active monitoring rules for that specific file or command.
4. Select a specific Watcher from the list.
5. In the Standard sub-tab, locate the Match Expression field. This field contains the specific string or regex that the probe is searching for.
   
   Note: If the expression starts and ends with forward slashes (e.g., /[Ee]rror/), it is being treated as a Regular Expression.
6. (Optional) Check the Variables tab within the same Watcher. Sometimes strings are captured into variables and used later in Thresholds to trigger alerts based on numerical values found within the log.

Method 2: Examining the logmon.cfg File

If you have access to the file system of the robot, you can check the configuration file directly:

1. Navigate to <Nimsoft_Installation_Path>/probes/system/logmon/.
2. Open logmon.cfg in a text editor.
3. Locate the section for your profile. Look for the active = yes flag.
4. Under the <watchers> section, find the match key.
    Example: match = *Critical Error*
    Example (Regex): match = /.*(Failed|Timeout|Refused).*/
   
   
   Important Considerations
   
   Match on Every Run: Check the Advanced tab of the Watcher Rule. If "Match on Every Run" is enabled, the probe may trigger an alarm even if the string is not found (inverted logic).
   Multiple Strings: A single watcher may be configured to trigger on multiple strings using the OR operator (|) in a regex. Example: /error|failure|denied/.