Monitoring log-files

Hello,

thank you very much for your KB-Post. I'm very much afraid the File Content Sensor is not able to "solve" this task. You could achieve this though with a self - written Custom Exe/Script Sensor.

Best regards.

Darina,

I use the File Content Sensor with a custom script to perform what you are referring to. Example powershell below to retrieve the latest log file, parse out the last 25 lines to a file, point the File Content Sensor to that file to only see the end of the log file.

Configuration Guide:

1. Open both elevated x86 and x64 Powershell, set-executionpolicy Unrestricted
2. Add service account user to ACL for c:\scripts, permit read/write
3. Configure task scheduler to run the script every 10 minutes, run as service account
4. Configure the sensor to check this file and roll-up to the sensor ID ever 10 minutes
5. Change select - Last from 25 to however many lines you want to parse at the end of the log file

$files = Get-ChildItem \\servername\logpath\logfile* | Sort-Object LastWriteTime -descending
$fileName = $files[0].FullName

Get-Content $fileName | select -Last 25 > c:\SearchStatusMonitor.log

Randolfini,

Thank you, I'll try to configure it the way you suggested. Just one question - what do you mean by "roll-up to the sensor ID ever 10 minutes"? I'm afraid I'm not quite getting this part, could you please explain it?

Darina,

Sure, sorry I didn't explain #4 very well. I've found that if I use the built-in sensor for file content it has issues reading the file (cannot recall all the details, but it is a permissions problem). So instead I use the stand alone sensor, LogFileReader.exe, which should exist in C:\Program Files (x86)\PRTG Network Monitor\Sensor System\, or just Program Files if you are not running the x64 version.

Add a custom sensor, EXE/Script, find LogFileReader.exe in the list. In the parameters field I use -f=C:\Scripts\SearchStatusMonitor.log -s="system error code" -id=32563 -l

The parameters are
-f=file
-s=searchstring
-id=sensorID *This is where you put the sensorID of the sensor you created and what I meant by "roll-up to the sensor ID"
[u-username]
[-p=password|passwordhash]
[-r=RegEx]
[-l] Optional, returns the linenumber of the found string
[-t] Optional, returns the found textline as output message

Randolfini,

Got it! Thank you very much again for your suggestion and help.

Something to add, the script is looking for a file that confirms to your name and then it looks for the most recent one. This is useful for log files that roll daily.