XpoLog help - Monitors 
 
General
XpoLog's monitors is a mechanism that enables you to check at any given point of time the health state of your system based on your defined logs. Based on it's parsing and filtering capabilities, XpoLog allows you to check whether certain conditions apply to given logs and filters. The basic idea is to define failure conditions for log: these conditions are based on the number of records a filter for a given log returns. You can define for instance a string filter on a log, so that only records containing the value 'error' will pass the filter. Based on that filter you can now define a monitor that fails if the result of the filter on that log contains more than 1 record, for instance.

Monitors could then be used in tasks, so that XpoLog automation mechanism could inform you in the case of monitor failure.


Defining a log monitor
  1. Open the Administration menu in the top menu and click on the 'Add monitor' option.
  2. Click on the 'log monitor' link.
  3. In the Global section, enter the monitor's name.
  4. Now you need to specify the logs and filters that belong to the monitor, by browsing the tree and selecting filters.
    Pay attention to the following behavior executed by XpoLog:
    • If you choose one filter of one log, a simple log monitor will be created. The monitor will use the selected filter.
    • If you choose two filters or more of the same log, a new multi filter will be created in the log (containing the selected filters) and the monitor will use the new multi filter.
    • If you choose one filter of one log and another filter of another log, a multi monitor will be created, containing two new simple monitors.
    • You can go on and build more complex monitors, and XpoLog will create the filters, multi filters, monitors and multi monitors according to you selection.
    Upon monitors activation (see below), XpoLog will start scanning the log based on the given log. If the 'Scan log from last scan stop' option is selected, XpoLog will scan from the last scan location: if the monitor failed, the last scan location will be updated to the location where it failed; otherwise it will not be updated. This option is especially important in the case of a monitor task that runs from the scheduler: you don't want the monitor to rescan the log each time from it's beginning but rather from the location it failed last.
  5. In the Rules section, enter the condition that will define a monitor failure. The two options you have are simply 'more than' and 'less than'; now give the number of records to complete the rule definition.
  6. In the Actions section you can define a set of actions to take place both for monitor success and for monitor failure. see Tasks for information on defining tasks.
  7. Click the 'save' link.

Defining a multi monitor
You can define a multi monitor based on multi monitors. This is a recursive definitions that allows you to define more complex monitors, so that a multi monitor's success or failure will give you a measure of the systems health in higher levels, not only that of a single log. Follow the steps below to define a multi monitor:

  1. Open the Administration menu in the sliding menu and click on the 'Add monitor' option.
  2. Click on the 'multi monitor' link.
  3. In the Global section, enter the monitor's name.
  4. In the Setting section, select the monitors you want your multi monitor to be based upon.
  5. In the Rules section, enter the condition that will define a monitor failure. Define here a disjunction of the children monitor by selecting 'at least one monitor failed', or a conjunction of the children monitors by selecting 'all monitors failed'.
  6. Proceed in the Actions section as with log monitors, selecting the actions you want to take place both in failure and success of the monitor.

Running a monitor
  1. In the XpoLog folder tree on the upper left side of the screen, click on the 'monitors' node or on any of the monitors you defined.
  2. In the main window you will see the sub-tree of the monitors with the selected monitor as the root
  3. Click on the 'update View' link to start scanning the monitors. If you want XpoLog to run the tasks defined for the root monitor, check the 'Activate root tasks' option; if you want to run the tasks defined for the children monitors, check the 'Activate children tasks' option.
  4. For each of the monitors listed XpoLog displays a red dot for monitor failure or a green one for success.
  5. Each click on a monitor will 'drill down' and display the log as a root of a new monitor tree. If this root has no children (that is, when the monitor is a log monitor), clicking on it again will 'drill down' and show the log view (the monitor's log with the selected filter active).

 

 

Additional links

      Automation