What is this?

This knowledgebase contains questions and answers about PRTG Network Monitor and network monitoring in general.

Learn more

PRTG Network Monitor

Intuitive to Use. Easy to manage.
More than 500,000 users rely on Paessler PRTG every day. Find out how you can reduce cost, increase QoS and ease planning, as well.

Free Download

Top Tags


View all Tags

File Content sensor and rolling logs

Votes:

0

Hi,

I am planning to use the File Content sensor to tail an application's log file.

Unfortunately, when the file gets to certain size, it moves the file into a folder and append a increasing number to the name.

After it will create a new file with the same original(without number) name.

My question is, because of the interval (minimum 30 seconds), will data get lost in cases such as:

1. During the 30 seconds wait time, log is rolled over (backed up, new file created with the same name). If there's a new line per second we could lose 20+ lines?

2. A time window however minuscule, during the instant PRTG polls and log is rolled at the same time.

Does the sensor has some sort of mechanism to deal with the above scenarios? It doesn't seem (because of the intervals) that PRTG does not have constant real time handle on the file?

Thanks!

file-content logs rolling-log

Created on Jul 6, 2016 3:37:20 PM



5 Replies

Votes:

0

Unfortunately, the sensor doesn't allow for wildcards within the file name. You may need to come up with your own custom sensor. This thread might be what you're looking for.

Created on Jul 7, 2016 1:49:16 PM by Stephan Linke [Paessler Support]



Votes:

0

I am sorry if I was not clear, the log file name that File Content sensor is pointing to will always have the same name.

Only, if I gets to a certain size it will be moved and a blank file of the same name will be placed exactly in the same location with the same name.

My question is: [Q] Can PRTG File Content sensor handle rolling logs? Will data be lost when a log is rolled over during the minimal 30s interval?

For example, I am tailing file "file.log" and the following are happening:

  1. file.log had 5 lines appended.
  2. PRTG probes for new lines.
  3. 30 seconds wait...
    1. 5 more lines appended.
    2. file.log renamed to file.log.1 and moved to ./logs/ folder.
    3. new ./file.log created.
    4. 5 more lines appended.
  4. PRTG probes for new lines.

Question Are the lines created in c1 lost?

Created on Jul 7, 2016 3:01:40 PM

Last change on Jul 8, 2016 5:40:53 AM by Stephan Linke [Paessler Support]



Votes:

0

Yes, since the file is renamed, therefore PRTG only checks the "new" file.

Created on Jul 8, 2016 5:41:13 AM by Stephan Linke [Paessler Support]

Last change on Jul 8, 2016 5:41:23 AM by Stephan Linke [Paessler Support]



Votes:

0

And by the way, the previous post that says this topic "File Content sensor and rolling logs" solves the content monitoring of rolling logs is false. That topic covers monitoring a log file with changing filename, not the contents of said file. It will give you stats on when the file changed how old etc, and will not work when trying to monitor for specific content within the log file, like "Access Denied". Unless I misread.

Created on May 27, 2017 11:23:02 PM

Last change on May 29, 2017 5:37:59 AM by Luciano Lingnau [Paessler]



Votes:

0

Hi pir8adio,


That's true - you'll need to modify the script accordingly in order for it to check for content.

Kind regards,
Stephan Linke, Tech Support Team

Created on May 29, 2017 7:17:25 PM by Stephan Linke [Paessler Support]




Disclaimer: The information in the Paessler Knowledge Base comes without warranty of any kind. Use at your own risk. Before applying any instructions please exercise proper system administrator housekeeping. You must make sure that a proper backup of all your data is available.