Behavior Models Cookbook - Vendor Models - SnmpresGenericLogMonitor -
Previous: SnmpresDiskUsage     Next: SnmpresLoginMonitor

SnmpresGenericLogMonitor

Path: /model/vendors/snmp_research/snmpres_generic_log_monitor.mod

This behavior model monitors log file events reported by SNMP Research's CIAgent. When the amount of events reaches the threshold (three by default) within a specified time (the default is fifteen minutes), NerveCenter sends a 110081 Inform to the platform. If the time expires before the threshold is reached, the alarm is grounded and inform 120081 is sent. The nodes monitored must be associated with a property group that contains the property siLogEntry.

---

Note    This model is provided by: Southernview Technologies, Inc., http://www.southernview.com, 877-795-7958, sales@southernview.com.

---

Property

The following property must be in the property group for the nodes hosting the applications you want to monitor:

siLogEntry

Trigger Generators

Below is a list of the objects that generate triggers:

• LogFileEvent (mask)
• LogFileEventWarning (alarm)
• LogFileEventTimer (alarm)

Events Sent to OpenView

The table below summarizes the events this behavior model sends to OpenView:

For complete information about events sent to OpenView, see the trapd.conf.txt file shipped with these behavior models residing in:

/model/vendors/snmp_research

For more information about integrating NerveCenter with OpenView, or the other NerveCenter-supported network manager platforms, refer to the book Integrating NerveCenter with a Network Management Platform.

Optional Customization

Below is a list of behavior model settings that you might want to customize to suit the requirements of your site.

---

Tip    It's a good practice to rename the behavior model objects that you modify. Whenever you import a model, NerveCenter will overwrite objects with the same name.

---

• Set timers and counters for persistence
• Change Inform to Inform Platform for Netcool, TME, Unicenter
• Configure the mask to instantiate different alarms according to the log entry received

CIAgent Customization

The following is a list of sample CIAgent configurations that you might want to customize to suit the requirements of your site:

• On Windows, there are three log files: Application, Security, and System. In order to monitor entries within them, you must not use the path to the file in the configuration entry. Instead, use "Event Log: log filename: source", where log filename is the name of the log file; that is, Security, and the source is the application or service generating the log entry. Below are two sample entries; one matches a "failed to renew" string in a Dhcp event in the System log; the other matches "application error" strings in DrWatson events in the Application log:

  siLogEntry 1 System "Event Log: System: Dhcp" "failed to renew" 2 4 0 1 - 1 \ 2031616 0 - 2 10 2 System 1

  siLogEntry 2 Application "Event Log: Application: DrWatson" "application error" 2 4 0 \ 0 - 1 524288 0 - 2 15 2 Application 1

  The default path to the CIAgent log file monitoring configuration file on Windows is:

  C:\etc\srconf\agt\logagt.cnf

• On UNIX, the location of the log files varies for every platform and application. Below are two sample entries for monitoring the syslog files on Solaris and on HP-UX, respectively:

  siLogEntry 1 Syslog /var/adm/messages "login: *pam_authenticate: *error" 2 10 \ 200 25 - 1 8233138 0 - 2 15 2 System 1

  siLogEntry 3 Syslog /var/adm/syslog/syslog.log "sendmail: *SYSERR* exiting" 2 10 0 \ 0 - 1 8233138 0 - 2 15 2 system 1

  The default path to the CIAgent log file monitoring configuration file on UNIX is:

  /etc/srconf/agt/logagt.cnf

  ---

  Tip    Verify that the appropriate message level for the events you are trying to monitor is configured in the /etc/syslog.conf file.

  ---