logmon - creating alarm exclusions/exceptions using exclude rules or regex

Products

• DX Unified Infrastructure Management (Nimsoft / UIM)

Issue/Introduction

Goal

To configure the logmon (Log Monitoring) probe to ignore or exclude specific log entries while continuing to alert on a broader pattern (e.g., alerting on all 'WARNING' messages except for one specific known exception).

Environment

DX Unified Infrastructure Management (UIM) - All Versions
Probe: logmon (any version)

Resolution

Using an Exclude Rule

You can configure exclude rules to define text or expressions to be excluded for monitoring. The probe ignores these text blocks or lines where the excluded text or expression exists. You can define more than one exclude rule.

Follow these steps:

1. Select the required profile.
2. Open the Exclude Rules tab.
3. Right-click and select New. The Add New Exclude Definition dialog appears.
4. Enter a name for the rule.
5. Click OK. The exclude rule is created.
6. Specify text or expression to exclude lines or blocks of input from monitoring.
   
   Each block or line of input is checked to see if the expression entered in the Exclude Expression field is found. If a match occurs, the line or block is ignored and does not trigger any action, regardless of any other watchers set.

Using a negative lookahead regex

Another option is to build the exclusion into your match expression with a regex. To exclude a specific string while matching a keyword, use the following syntax:

/(?!.*EXCLUDE_STRING).*MATCH_KEYWORD.*/

(?! ... ): This is the negative lookahead. It tells the regex engine to fail the match if the following pattern is found.

.*: Matches any characters leading up to the exclusion string.

MATCH_KEYWORD: The actual term you want to alert on.

Practical Example

Scenario: You want to alarm on any log line containing WARNING, but you want to ignore the following specific line: WARNING|com.sun.messaging.jmq.jmsclient.ExceptionHandler logCaughtException|[I500]: Caught JVM Exception: java.lang.NullPointerException

Configuration: In the logmon Watcher Rule, set the Match Expression to:

/^(?!.*WARNING|com.sun.messaging.jmq.jmsclient.ExceptionHandler logCaughtException|[I500]: Caught JVM Exception: java.lang.NullPointerException).*WARNING.*/

Note: Special characters like |, [, and ] must be escaped with a backslash () in the regex.

Handling Multiple Exclusions

You can chain multiple negative lookahead groups to exclude several different patterns at once:

/^(?!.*EXCLUDE_1)(?!.*EXCLUDE_2)(?!.*EXCLUDE_3).*MATCH_KEYWORD.*/

Example with two exclusions: /^(?!.*NullPointerException)(?!.*OutOfMemoryException).*WARNING.*/

 

Additional Information

logmon advanced IM configuration

logmon use case examples