How to create a logmon watcher rule for monitoring a ptpd log for time drift.

Document ID : KB000034691
Last Modified Date : 14/02/2018
Show Technical Document Details

Introduction

Monitoring a ptpd log for time drift - logmon alarm field.
Needing a watcher rule, with variables defined on a field seperator of ,
The field being looked at is a + or - value that is a decimal. Question is how to trigger when it is outside 1 < x > -1. The example number is -0.000001218, and the need is to know if it is ever -1.0 or +1.0. How to do this...




Procedure

A method of creating a logmon watcher to monitor the skew of the ptpd daemon time,

Example:
Wanting to generate an alarm from the column 5 of the following logfile line (-0.000001218) when it is > 1.0 or less than -1.0. Logfile line to parse -
2014-11-05 16:19:06.424183, slv, 001c73ffff410921(unknown)/06f45214fffe835a21,? 0.000003835, -0.000001218,? 0.000002637,? 0.000003280, 17307.726000000, S, 0.000000000, 0, 0.000000404, 951, 17310, 0
?
?Solution:
Using a regex in the search field of the watcher:

/^[^,]*,[^,]*,[^,]*,[^,]*,\s+-*([1-9]\d*\.|\.[1-9]|\.0[5-9])/

This will skip to the fifth field in the log line and test for any number values that are < -0.05 and > 0.05. The regex could be modified for other ranges.

Next also added a second watcher that clears the alarm when it returns to a good value:

/^[^,]*,[^,]*,[^,]*,[^,]*,\s+-*(0+\.0[0-4])/

This could be a very useful watcher for someone else who needs to monitor the skew of the ptpd daemon time,