6 Replies Latest reply on Dec 17, 2013 4:32 AM by kolev

    LEM log4net connector to folder

    kolev

      Hi

      we have a configured DFSR which collects log4net app.logs from many servers to one server.

      And we need to analyse these logs. The problem that I met is when I create log4net connector on that server, in the "path" settings i have to put the exact path+filename of the log file.

      If the path contents only a folder path the connector doesn't starts. but we have many files and many folders (for every server and application).

      So my question is, how to set the log4net connector to folder including subfolders?

       

      Thanks!

      Nikolay Kolev

        • Re: LEM log4net connector to folder
          curtisi

          I took a look at that connector, and my guess is that you'd need to do a connector for each sub-folder.  As an experiment, can you try building one that points to a specific log for one of your apps and see if it reads data?

          • Re: LEM log4net connector to folder
            nicole pauls

            The way the connector is built at the moment, it tracks a specific file, so it'd require multiple connector aliases to monitor each one. This is your best bet.

             

            However, if there's also dates in the filenames, we can support that with some configuration magic on our end to make the connector more flexible. It would be unfortunate to have to reconfigure every day

            • Re: LEM log4net connector to folder
              kolev

              Hi and thanks for the response.

              I reached the same conclusion, so I've created connectors for every folder and connected it to the corresponding log files.

              The problem that I meet is that the connectors for some reason "sleep" and doesn't index and collect data from the files.

              In the first day when I created and started it they collect about 6000 issues from these log files which looked good and I was happy.

              On the second day I had about 1000, yesterday 175 and today 3.

              Hm, wtf ?

              I manually open one of the log files and see that there are about 11000 issues logged yesterday. The connector to the file is started and never been stopped.

              So I wonder how to schedule this collection of the events.

                • Re: LEM log4net connector to folder
                  curtisi

                  kolev: If you've upgraded to LEM 5.7, there's a Hotfix 1 that specifically relates to the Log4Net connector.

                   

                  From the ReadMe:

                   

                  Agent Issue Resolved

                   

                  • This resolves support case 535995 - Unable to start/stop connector instances

                    - This only needs to be done if using the "Log4Net" connector

                  • This resolves support case 268630 - Unable to report Nessus related events

                    - This only needs to be done if using the "Nessus Security Scanner NBE Report" connector

                   

                  You may want to deploy the Agent fix (you can get it from the customer portal) and see if that resolves the issue.

                  • Re: LEM log4net connector to folder
                    nicole pauls

                    Tough to say for sure, it could be that they aren't matching the expected format in some cases, or there could be an actual technical problem. Can you provide some sample data that is/isn't appearing? (You can also do this in a support case if it's data you don't want to post on Thwack.)

                  • Re: LEM log4net connector to folder
                    kolev

                    I think the problem in is that the application logs are circular. I mean for examp the app1 creates its log under name app1.log and I put this file to the connector. The app logs have a limits of 3 mb so when they reach this size, the file renames to app1.log.1 (app1.log.2, app1.log.3 and so on) and the application opens another log file under the same name app1.log.
                    OK I will try the upgrade and will inform you for the result.

                     

                    Thanks!