Questions about PRTG capabilities. Need answers/confirmations.

Hello Kusumah,
thank you for your post.

I'll try to reply to each individual inquiry below:

1. Rolling logs

[Q] Can PRTG File Content sensor handle rolling logs? Will data be lost when a log is rolled over during the minimal 30s interval? For example tailing file "file.log":

[A] What exactly would the sensor be looking for? Please note that the "Only transmit to PRTG new lines at the end of the file (default)" option is still Beta and may not always behave as expected, in general rolling logs are hard to monitor, since previous occurrences of keywords will still be accounted for.

        a. file.log had 5 lines appended.
        b. PRTG probes for new lines.
        c. 30 seconds wait...
            c1. 5 more lines appended. (is this gone?)
            c2. file.log renamed to file.log.1 and moved to ./logs/ folder. (does the sensor crash/error on missing file?)
            c3. new ./file.log created.
            c4. 5 more lines appended.
        d.PRTG probes for new lines. 

[Q] Are the lines created in c1 lost?

[A] Yes, if changes happen to the file outside the scanning interval and then are edited, they cannot be picked up, ex.:

• 00:00:00 - Original File Status
• 00:00:30 - File Scanned by the sensor
• 00:00:21 - Previous Lines Added
• 00:00:40 - Lines removed
• 00:01:00 - File scanned by the sensor <- This "state" of the file will be evaluated.

And when deploying the sensor a path has to be informed, if the file is moved the sensor will go into error because the file is missing.

2. Confirm PRTG Core (Server) migration (cloning) steps.

We will be installing core servers on different sites and they need to be configured as efficiently as possible. Minimal user intervention is key.

[Q] Is there a process to streamline the installation of the core server? Like an answer file that the Installation reads from. Essentially we want to make a backup of an installation and restoring(configurations, logins, logs, etc.) to other machines.

[A] The Core Server does not officially have a silent install, but you could export/import registry keys and copy the data from the "source" server before deploying the "clone", this is not officially supported but should work, but you might encounter issues with activation/licensing for commercial versions.

[Q] If there is, is the same process applicable to Remote Probes? I understand we can install from WebGUI but at some sites that might not be possible (lack of suitable man power) and no way to remote.

[A] For the remote probe, please review this article.

3. [Q] Can sensor messages (E.g. Windows Event Logs) be used as a positional parameters for PowerShell scripts that are run by Notifications?

For example: One event detail is "Low disk space on...", can we use that sensor message as a parameter for a script/exe?

[A] Yes, the placeholder is %lastmessage or %message, but the script must be able to "parse" the message as it may contain additional text. Please review the complete list of placeholders here:

• What placeholders can I use with PRTG?

4. [Q] Does PRTG store its data (Log of sensor messages) in plain text files that we can parse (weekly) for textual information to complement PRTG reports that only shows metrics?

[A] PRTG Stores the messages in a proprietary format, they're not encoded in plain text. However, please note that via the HTTP API you can query the logs/events of any PRTG Object. For instance to query the messages for the Probe Device you would use:

For more information, see PRTG Manual: Application Programming Interface (API) Definition. You can use the query builder to test the API.

5. In a Sensor settings there is "Write sensor result to disk...", [Q] can PRTG include these in Reports? [Q] What exactly are "Data Files" in Report templates?

[A] The results are debug text files which are stored under the following path:

They are for debug/troubleshoot only, and can't be included in reports/logs, please also note that not all sensors have this option. The Data Files in reports are additional CSV / XML Files which can be generated when a report is run. Please review:

• PRTG Manual: Report Settings

6. [Q] Can scheduled Reports run script/exe?

On a weekly basis I would like PRTG to also use a script that will send files (logs, etc.) in a separate email.

[A] This is not possible, consider using a windows scheduled task and PRTG's API to create such reports/logs, as this is not supported by PRTG.

7. Custom Sensors and the limitations

[Q] Is this write-up correct? Complete?

[A] This is mostly correct, as for:

When PRTG is reading data from a custom sensor, the custom sensor must provide the data/reading, if the script is able to output the culprit process which is using most CPU as the sensor's message, it would show up in the sensor's overview and in notifications(triggered by any channel), ex.:

<prtg>
  <result>
    <channel>CPU Core 1</channel>
    <value>90</value>
  </result>
  <result>
    <channel>CPU Core 2</channel>
    <value>20</value>
  </result>
  <text>Top CPU Intensive Proecesses: iexplorer.exe, calc.exe, mmc.exe</text>
</prtg>

There's an example here:

• Sensor for BGP status

The logic behind that sensor is:

If there are connections which are not established, append them to a huge string and display them as the sensor's message.

Custom sensors comes in two flavors, single and multi channel.

A sensor has at least one channel, a channel is basically a name:value pair that the sensor displays such as "CPU:80". The name is static, only value will change.

• a. The first custom sensor only has one channel, for example if that channel were only to monitor 'Application' open ports, the return value from the script is a one line string, For example: "'Application' Open Ports:10".

The channel will exclusively show the open ports of 'Application', the channel can set threshold triggers to send notifications when certain conditions are met.

• b. The second sensor can have multiple channels, for example this is the XML output by a script/exe:

<prtg>
  <result>
    <channel>CPU Core 1</channel>
    <value>10</value>
  </result>
  <result>
    <channel>CPU Core 2</channel>
    <value>20</value>
  </result>
</prtg>

Inside the Sensor view, you will see two name:value pairs that reports on the CPU usages of Core 1 and Core 2. Each core has(is) a channel and each channel can bet set a threshold trigger that can send a notification when certain conditions are met.

The limitations would be, it can only return numerical data (int, floats). This is because PRTG only reports on metrics (graph, count) and does not have a deep Analysis component (E.g. Top processes names when CPU is over 80%).

I hope this answers your questions, but please let me know if there are further questions that you would like to address/discuss.

Best Regards,
Luciano Lingnau [Paessler Support]