Using logmon probe variable exceed alarm functionality

Document ID : KB000010880
Last Modified Date : 14/02/2018
Show Technical Document Details
Introduction:

How to generate alerts when variables breach threshold for a specified match count in a monitored check interval .

We will utilize the variable exceed alarm functionality of logmon probe.

Single alert will be send when both conditions 1 and 2 are met for a specific watcher

Condition1

All the variables defined in the variables tab under specified watcher breach threshold

Watcher rules ->watcher_xxx -> Variables

 

Condition 2

The Minimum Match Count condition

Watcher Rules -> Alarm->Variable Exceed Alarm->Minimum Match Count

Minimum Match Count: Defines the minimum number of times the threshold breach for all defined variables must occur for the probe to generate the alarm.

 Note: The Variable Exceed Alarm is applicable for the Update and Command mode. Setting the alarm disables the watcher rules.

 

Background:

This is a new feature introduced in logmon probe version 3.91

Environment:
UIM 8.4xUIM 8.5xlogmon 3.91 and higher
Instructions:

Steps to demonstrate functionality

  1. Using a windows batch file which outputs sample numerical values in a line . We will match columns 2 , 3 and 4 on each line for threshold breach. Configure a new logmon profile to execute the batch file say every 20 seconds.

 image1.png

 

2. Configure a new logmon profile to execute the batch file say every 20 seconds. This is test600 in this example

image2.png

 

3. Configure a new logmon profile to execute the batch file say every 20 seconds. This is test600 in this example

image2.png

 

4.Create a Watcher Rule

In the Watcher Rules tab -> Standard tab of the rule -> Match Expression field, specify the expression to match in the command response.
 For example, specify /test.*/ to match for lines with this string.

image3.png

 

5. Configure Custom Variables in Watcher Rule

You can configure custom variables and use the variable in the alarm message text. You can also configure QoS messages for these variables.

Follow these steps:

  1. In the Variables tab, create a variable. For example, create a variable var1 that extracts the value from column 2 and checks if this exceeds specified threshold

image4.png

2.  Repeat the above for new var2 and var3 variables to extract column 3 and column 4 from each line containing string test

image11.png

image6.png

image8.png

   

6. Configure the Watcher Rules -> Alarm ->Variables Exceed Alarm ->Minimum Match Count and Alarm text

image7.png

      Minimum Match Count: Define the minimum number of times the threshold breach for all defined variables must occur for the probe to generate the alarm.

 

 Severity: Define the severity of the alarm. The probe will generate the alarms only for the defined severity. If you do not define any minimum match count value and severity, the probe sends  the default message defined in the Standard section.

 

 Suppression Key: Define the suppression key to avoid multiple instances of the same alarm

 

7. Alarm is now generated by logmon as thresholds are breached for configured check interval

image12.png

 

    Alert Details as seen in Dr Nimbus

image13.png

 

Additional Information: