Linux Logfile monitoring for folders and log file names that change daily

asked 2020-09-29T18:13:55.987+00:00
Bixby 81 Reputation points

We are running SCOM 2012 R2.

I have created Linux logfile monitors in the past, but I have a question concerning a customer request that I'm not sure how to tackle.

The customer wants a log file monitored, but the log file folder/directory and the logfile name changes daily. For example:

Log file folder name = Contoso_XXXXXX.12345
Log file name = Contoso_XXXXXX.12345.log

The "12345" portion of the both the log file folder and the Log file change daily.

Is there a way to configure and monitor this in SCOM?

Thank you for your suggestions

Operations Manager
Operations Manager
A family of System Center products that provide infrastructure monitoring, help ensure the predictable performance and availability of vital applications, and offer comprehensive monitoring for datacenters and cloud, both private and public.
1,200 questions
No comments
{count} votes

Accepted answer
  1. answered 2020-09-29T18:31:05.38+00:00
    Leon Laude 84,981 Reputation points

    Hi @Bixby ,

    You would have to use wildcards to be able to monitor log files/folders that change daily, as far as I know the builtin UNIX/Linux log file monitor in SCOM 2012 R2 cannot handle wildcards.

    You could have a look at the following community management pack:
    UNIX/Linux LogFile Monitoring Library MP

    Here's a blog post the author of the above management pack wrote about Linux log file monitoring with his custom management pack:
    Lifting limitations for monitoring UNIX/Linux LogFiles using SCOM

    Otherwise you could also try to use a monitor based on a shell script to achieve this:

    In SCOM 2019 the Linux log file monitoring has been enhanced with the following:

    • Wild card characters in log file name and path.
    • New match patterns for customizable log search like simple match, exclusive match, correlated match, repeated correlation and exclusive correlation.
    • Support for generic Fluentd plugins published by the fluentd community.

    On a side note, it might be worth considering an upgrade of your SCOM environment soon, the newer SCOM versions offers a lot of nice new capabilities.

    ----------

    (If the reply was helpful please don't forget to upvote or accept as answer, thank you)

    Best regards,
    Leon


0 additional answers

Sort by: Most helpful