This section provides examples for using the watch logfile directive in the sysedge.cf file to add log monitor entries to the Log Monitor table.
Example: Search for pop Connection Attempts
The following example instructs the agent to add an entry to the Log Monitor table at table index 15 to search for pop connection attempts on a system and send a trap with a warning severity when a match occurs:
watch logfile 15 0x00 /var/log/syslog 'popper' 'NOTICE - pop connection' '' 1 warning
Example: Search for su Attempts
The following example instructs the agent to add an entry to the Log Monitor table at table index 16 to search for su attempts on a system and send a trap with a critical severity when a match occurs:
watch logfile 16 0x02 /var/adm/messages 'su.*fail' 'WARNING - su attempt' '/local/bin/mail2admin' 5 critical
Specifies that the agent should not send traps. Instead, the agent invokes the specified action command.
Examples: Monitor Directory Size and Contents
The following example instructs the agent to add an entry to the Log Monitor table at table index 17 to monitor the /var/tmp directory for size and number of files.
watch logfile 17 0x00 /var/tmp 'Temporary directory' '' 5
You can create a self monitor entry to put thresholds on the size (logMonitorLogFileSize) and contents (logMonitorLogFileCount) attributes.
The following examples instructs the agent to add an entry to the Log Monitor table at table index 232 to monitor a directory for size and number of files.
watch logfile 232 0x1800 'C:\testdir23' '' Monitor for dir testdir23' '' 1 warning
Flag 0x0800 can be used for monitoring directory non-recursively. In addition to this, create a self monitor entry to put thresholds on the size (logMonitorLogFileSize) and contents (logMonitorLogFileCount) attributes.
monitor oid 1.3.6.1.4.1.546.11.1.1.8.232 2323232 0x8 30 absolute >= 10 'Directory Size is more than 10 bytes' '' 0 (or) monitor oid logMonitorLogFileSize.232 2323232 0x8 30 absolute >= 10 'Directory Size is more than 10 bytes' '' 0 monitor oid logMonitorLogFileCount.232 2323231 0x8 30 absolute >= 10 'FileCount is more than 10' '' 0 (or) monitor oid 1.3.6.1.4.1.546.11.1.1.16.232 2323231 0x8 30 absolute >= 10 'File Count is more than 10' '' 0
Example: Search for a Pattern on Multiple Lines
The following example specifies a regular expression that instructs an agent to add an entry in the Log Monitor table at table index 20. The entry is used to search for text that appears across multiple lines in the monitored log file. In this example, the text “WARNING:” appears as an unspecified number of lines before the text “Invalid login attempt”.
watch logfile 20 0x00 /var/log/syslog '/^WARNING:(.*\n)*Invalid login attempt/m' 'NOTICE - Invalid login attempt' '' 1 warning
Note: This example requires Perl Compatible Regular Expressions(PCRE) to be activated on the agent using the Policy Configuration Control Settings, or using the SystemEDGE configuration file (if in Legacy Mode).
|
Copyright © 2013 CA.
All rights reserved.
|
|