Open for Voting

SAM monitor to trace log files

For custom applications (or SolarWinds itself) one may need check given file for known messages (or REGEXP).

If application don't report to WIndow's system logs then one need Application Monitor dedicated to check logs in flat (text) files, preferable with regexp and not reading whole file every time

Logchecker store offset for each log and reads only new lines, but logchecker operates locally on sever, so maybe it can be done by agent?

  • I agree.  I would love for SAM to have the built in ability to monitor log files for several conditions:

    - grep for a string or strings (or more specifically, regex patterns) and alert if file does or does not contain the strings

    - check modified time and alert if not modified in x minutes

    - monitor for log file size ( too big or 0 bytes, etc),

    - Alert if file does or does not exist (if it needs to be monitored for content)

    - Be able to "follow" a log that may be backed up or "rolled" to a new log file ( e.g. monitor a file with a name that may change over time, like the name contains a date-time stamp) so the current log is always todays date)

    - Be able to handle "very large" log files that may write a lot of data or be rolled over infrequently

    There's almost endless permutations of conditions to look for, as application logging is so diverse.

    I've written several my own file parsing/watching templates using SAM and vbscript , and I've often had to make a "cache" directory on the local poller to handle temp variables my scripts need (mostly the last time I read the file so my script can start from the last byte read on the next poll).  I'm not sure if this is necessary, but the point I'm trying to make is it's kind of a pain having to roll your own all the time for some basic things.