The logmon probe in Unified Infrastructure Management (UIM) can be configured to generate an alarm after matching a string a specified number of times.
This has been successful in UIM v8.4+ with logmon v3.60.
logmon probe v3.60
- Follow the instructions in the probe documentation under create a profile (https://docops.ca.com/ca-unified-infrastructure-management-probes/en/alphabetical- probe-articles/logmon-log-monitoring/logmon-im-configuration#logmonIMConfiguration-CreateaProfile
- In addition to the standard set up described in the documentation make sure the following settings are enabled.
Mode = Updates
Generate Quality of Service = Checked
Generate Alarm = Checked
Watcher Rules Tab:
Match Expression = <string you want to match in the log file>
Create a Variable.
Double click on variable in table to the right.
In the pop up window set the settings as follows:
Source FROM Position = Match Expression
Source TO Position = Ignore 'To'
Expected Value Operator = <>
Expected Value Threshold = /*/
Check Count Matches
Select desired Variable
Set Count Matches Operator
Set Count Matches Threshold.