What is this?

This knowledgebase contains questions and answers about PRTG Network Monitor and network monitoring in general.

Learn more

PRTG Network Monitor

Intuitive to Use. Easy to manage.
More than 500,000 users rely on Paessler PRTG every day. Find out how you can reduce cost, increase QoS and ease planning, as well.

Free Download

Top Tags


View all Tags

Monitoring a log file with File Content sensor

Votes:

0

Hi,

The idea is fairly simple, we would like to monitor a log file for the string "Disconnect" and display/send an alert when the string matches. It works correctly the first time, when the string is found, but how do we reset the status so that the sensor will be triggered again the second time?

Thank you in advance.

file-content-sensor logfile trigger

Created on Mar 16, 2018 2:06:24 PM



Best Answer

Accepted Answer

Votes:

1

Hello roussoc,
thank you for your reply.

It is actually never "realtime", since sensors run in a specific scanning interval, which can be 30s, 60s, 5m, 10m and so on. There are very few times when you can actually have realtime, but that is usually not that much of a concern since any human intervention will take a lot more than 60s, so this "delay" becomes the smallest part of the total time to solution.

Also, since you've mentioned making a copy of the script for parsing, there are at least two ways to implement the custom script in PRTG:

  • HTTP Push Data Advanced sensor
    • If you have a scheduled task that does something, you could also leverage the scheduled task to parse the data and then use Invoke-Webrequest to push the result/statistics of the task to PRTG. This happens whenever the task runs, instead of based on the sensor's scanning interval.
  • EXE/Script Advanced sensor
    • When working with this sensor instead, PRTG will actually run your script/exe/file on every scanning interval, and the script will do whatever it is configured to do and lastly, it should include Write-Output to print the result/statistics (that you want to see in PRTG) to the console so that it gets picked up by PRTG whenever it finishes running.

For both sensors, the "format" of the data is essentially the same:

Best Regards,
Luciano Lingnau [Paessler Support]

Created on Mar 23, 2018 8:45:51 AM by Luciano Lingnau [Paessler]



4 Replies

Votes:

0

Hello there,
we appreciate your contact.

The only way to have this "working" is to actually configure incremental limits in the "Matches" channel of the sensor. This has to be done manually every-time the number increases, so that PRTG stops alerting because of let's say "3" matches and then alerts again when the 4th match comes up. But this isn't very high tech and you may encounter issue when the log rolls over, since the number of matches would then decrease.

For monitoring "Custom" software/applications/services, it usually makes more sense to write a custom-script. Have this script parse the log and for example, alert if there has been a "Disconnect" entry over the last 12 hours or 24 hours. This way, the sensor will "heal" automatically after a maximum period of 12 or 24 hours.

This sort of logic is not possible directly within the File content sensor

You can find custom-script examples here on the KB:

Best Regards,
Luciano Lingnau [Paessler Support]

Created on Mar 19, 2018 11:34:22 AM by Luciano Lingnau [Paessler]



Votes:

0

Hi Luciano,

Thank you for your reply.

Yes, we would be more interested in something automated than adjusting the threshold manually, anyway, we are not sure what the next value would be, as those strings could appear multiple times in a 5 minute time frame. The custom script idea would work somehow and it is already something I thought about, however, it cannot be real time monitoring, as there will be a scheduled task replicating the original log file to the new one for processing in PRTG.

Appreciate the assistance though, have a great day ahead.

Created on Mar 20, 2018 12:32:13 PM



Accepted Answer

Votes:

1

Hello roussoc,
thank you for your reply.

It is actually never "realtime", since sensors run in a specific scanning interval, which can be 30s, 60s, 5m, 10m and so on. There are very few times when you can actually have realtime, but that is usually not that much of a concern since any human intervention will take a lot more than 60s, so this "delay" becomes the smallest part of the total time to solution.

Also, since you've mentioned making a copy of the script for parsing, there are at least two ways to implement the custom script in PRTG:

  • HTTP Push Data Advanced sensor
    • If you have a scheduled task that does something, you could also leverage the scheduled task to parse the data and then use Invoke-Webrequest to push the result/statistics of the task to PRTG. This happens whenever the task runs, instead of based on the sensor's scanning interval.
  • EXE/Script Advanced sensor
    • When working with this sensor instead, PRTG will actually run your script/exe/file on every scanning interval, and the script will do whatever it is configured to do and lastly, it should include Write-Output to print the result/statistics (that you want to see in PRTG) to the console so that it gets picked up by PRTG whenever it finishes running.

For both sensors, the "format" of the data is essentially the same:

Best Regards,
Luciano Lingnau [Paessler Support]

Created on Mar 23, 2018 8:45:51 AM by Luciano Lingnau [Paessler]



Votes:

0

Hi Luciano,

Thank you for your reply.

I will have a look at what you have proposed and come back with questions, if any. Appreciate the input.

Created on Mar 26, 2018 8:04:36 AM




Disclaimer: The information in the Paessler Knowledge Base comes without warranty of any kind. Use at your own risk. Before applying any instructions please exercise proper system administrator housekeeping. You must make sure that a proper backup of all your data is available.