Monitoring Log Files with CCMS Agents

Purpose

One of the functions of CCMS agents is monitoring log files. You can use this log file agent, which is integrated into all agents, to monitor log files for particular search patterns, the last change time, or for their existence. This means that you can search any text files (such as database alert logs or ITS log files) for any text patterns, assign alerts to them, and display the results in the Alert Monitor.

If the agent finds the line for which it is searching, it transfers it to the central monitoring system. You decide the details of the message using entries in the configuration file of the log file agent:

· Color and severity of the alert or the message

· Assigned message

· Assigned analysis method

· Specifications about the position in the alert monitoring tree

In addition, you can monitor the existence and the last change date of particular log files, or display lines that contain a certain search pattern in the Alert Monitor.

Prerequisites

In general, a CCMS agent can only monitor those files that it has permission to read. In the case of the SAPCCM4Xagent, these are the files to which the adm user (UNIX) or the SAPService (Microsoft Windows) has access to, as this agent must always run under this user. In the case of the SAPCCMSR agent, these are the files that the user under which the agent is running has permission to read.

Process Flow

You can use CCMS agents to monitor the following types of log files:

· Log files that are continuously written by the application and are therefore constantly growing (such as the Oracle alert log alert_.log)

With these files, the agent reads newly added entries and saves its last read position.

· Log files that are rewritten under the same name by the application after each restart (such as the dev_w* files of the SAP application server)

With these files, the agent reads newly added entries and saves its last read position. Due to the smaller size of the log file, it automatically recognizes the restart of an application and in this case starts reading from the start of the file again.

· Log files that are created by the application with a new name each time (such as brbackup, brconnect, and so on).

The agent reads newly added entries and saves its last read position. It automatically recognizes the newest log files of a type, so that the current log file can always be monitored.

You can activate log file monitoring in the CCMS Agent configuration file SAPCCMSR.INI. Use the parameter LogFile, to specify a configuration file for each file to be monitored that contains the details of the monitoring (Log File Template). SAPCCMSR.INI can contain multiple entries with the following format:

LogFile
LogFile

For each log file template, you can specify a search criterion for the name of a log file (that can apply to more than one log file) and various text patterns that are to be monitored.

The log file agent also automatically identifies log file templates if they fulfill the following conditions; these log file templates therefore do not need to be specified in SAPCCMSR.INI:

· The names of the templates have the suffix logmon.ini.

· The templates are regular files (for example, not links), not larger than 10 kilobytes in size.

· The templates are stored in the folder \\\saploc\PRFCLOG\logmon
(Microsoft Windows, the folder must be released as a share; see Run Directory and Log Files of the CCMS Agents) or /usr/sap/tmp/logmon (UNIX).

You can also set the folder in which the log file automatically identifies the log file templates yourself using the parameter LogFileDir in SAPCCMSR.INI (see Configuration File of the CCMS Agent SAPCCMSR.INI).

You can use the optional entry LogFileParam DelTree to specify that subtrees should be deleted in the Alert Monitor if the associated log files no longer exist.