Having problems with your account or logging in?
A lot of changes are happening in the community right now. Some may affect you. READ MORE HERE
ericmorris Super Contributor.
Super Contributor.
296 views

matching multiple entries for logfile monitor

I can't seem to find anything in the documentation, but can you have one generic logifle monitor in SiteScope and serach for two possible entries?  For example, in OBM, I have a policy that has tro rules defiuned.  One looks for the word stuck in the log and one looks for the word error in the log.  Can you setup the content matching to look for either or do I have to dreate two differnt monitors?

0 Likes
4 Replies
Micro Focus Expert
Micro Focus Expert

Re: matching multiple entries for logfile monitor

Hello Eric,

 

Thank you very much for contacting MicroFocus Software Support.

 

My name is Diego Chaves, part of the SiteScope Team for  MicroFocus Software Services Department, 

After reading the forum notes I understand that we want to know if is possible to make a search for two possible entries, on SiteScope

 Yes this can be achieved with the use of the REGEX, and with the use of | , 

You can use as an example and guidance the image attach to the forum, 

Thank you very much for all your time and patience on this case,

I hope that you have a great day,

 

Best regards,

 

 

 

Miguel Torres
Micro Focus SW Support

If you find that this or any post resolves your issue, please be sure to mark it as an accepted solution.

[Opinions expressed in my postings are mine alone, and do not reflect the opinions of my employer.No warranties express or implied for any solution/suggestion posted.]
0 Likes
ericmorris Super Contributor.
Super Contributor.

Re: matching multiple entries for logfile monitor

That's not working for me.  I took two examples from the logfile and setup the multiple matches as you described.

/multiple IP addresses|Server state changed to RUNNING/

I used the content match tool and entered the entiore two lines and ran it and it's only detecitng the one match.

<Jan 27, 2019 11:04:46 AM EST> <Warning> <Server> <BEA-002611> <Hostname "servername", maps to multiple IP addresses: 10.1.12.34, 0:0:0:0:0:0:0:1>
<Jan 27, 2019 11:04:52 AM EST> <Notice> <WebLogicServer> <BEA-000365> <Server state changed to RUNNING>

Whole Match Between Slashes multiple IP addresses

 

It did not pickup on the Server state changed to RUNNING in the tool.

0 Likes
Highlighted
Micro Focus Expert
Micro Focus Expert

Re: matching multiple entries for logfile monitor

Hi ericmorris,

I have problems to understand your requirement.

Do you search for two possible phrases,
  so EITHER "multiple IP addresses" OR "Server state changed to RUNNING"
  and it's fine if there is one match only

or do you search for two exact phrases,
  so "multiple IP addresses" AND "Server state changed to RUNNING",
  and you need to find both?

To start with, it seems that we are looking at two lines here
..
<Jan 27, 2019 11:04:46 AM EST> <Warning> <Server> <BEA-002611> <Hostname "servername", maps to multiple IP addresses: 10.1.12.34, 0:0:0:0:0:0:0:1>
<Jan 27, 2019 11:04:52 AM EST> <Notice> <WebLogicServer> <BEA-000365> <Server state changed to RUNNING>
..
right?

Did you check
 Multi-line match  
under
  Log Monitor Settings
    Advanced Settings

This enables SiteScope to run the regular expression match on multiple lines of text.

I created a log file monitor using your sample data and the regular expression
"/multiple IP addresses|Server state changed to RUNNING/"
with "Multi-line match" checked, and it returns the data I think it should return, but as mentioned,
I don't know exactly what you need.

Will you have SiteScope trigger an alert when you have a match,
or do you create Match Value Labels?

Greetings
Siggi

Customer Support
Micro Focus

If you find that this or any post resolves your issue, please be sure to mark it as an accepted solution.
0 Likes
ericmorris Super Contributor.
Super Contributor.

Re: matching multiple entries for logfile monitor

I want the monitor to find either the words stuck or error from the logfile.  I don't have either of those two in the log (which is a good thing) so I was using samples from the log in the Regular Expression Tool to see what format I need to use in the content match string.  There is no option to use the multi line matching when using the tool, and it's only picking up the one phrase and not the other.  See attached photo for what I am trying to describe.

RegularExpression.PNG

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.