How to configure the logmon probe to monitor DX UIM OC wasp logs for login communication errors

Products

• DX Unified Infrastructure Management (Nimsoft / UIM)

Issue/Introduction

When experiencing intermittent login failures on the Operator Console (OC), it is useful to monitor the wasp.log for the specific error: User '<username>' login failed. (2) communication error.

This article provides the configuration steps to set up a logmon probe profile to trigger an Informational alarm when this specific error pattern occurs in the wasp.log file.

Environment

• DX UIM 23.4 and later
• Logmon probe

Resolution

1. Create a new logmon profile on the target OC server.

2. Configure the Watcher Settings:

   • active: yes
   • interval: 5 sec
   • scanfile: [Path to your wasp.log file, e.g., C:\Nimsoft\probes\service\wasp\wasp.log]
   • scanmode: updates
   • alarm: yes

3. Configure the Match Pattern: Use the following regular expression in the "Match" field to capture the timestamp, user, and error code:

   /^([A-Z][a-z]{2}\s+\d+\s+\d{2}:\d{2}:\d{2}:\d{3})\s+ERROR .* Login failed for (.*): javax\.security\.auth\.login\.FailedLoginException: User '(.*)' login failed\. \((\d+)\) communication error/

4. Configure the Alarm Message: Set the message to generate an Informational alert:

   Primary OC - Login failed for user '${user}' (Error: ${error_code} - Communication Error) at ${timestamp}

   Note: If configuring this on a Secondary OC, update the message string to "Secondary OC" to distinguish the source in your alarms.

5. Set Variable Definitions: Map the regex groups to the message variables so the alert contains the correct information:

   • Variable 1: $1 (Timestamp)
   • Variable 3: $3 (User)
   • Variable 4: $4 (Error Code)

6. Apply Settings: Save and apply the configuration. The probe will now generate an Informational alarm whenever the specified login communication error is detected in the wasp log.