Issue with SCOM Log File Monitoring - SCOM 2019

Question

First time attempted to create a simple Text Log File Rule using Authoring>Mgmt Pack Objects> Rules. Looks simple enough to to pick and alert on the word "Hello" in a text file named Test.txt. I have not used a trailing backslash in my directory path. Both System and the SCOM Action account have access to the Folder/File.

Somehow I am not getting any alerts being generated for this monitor, no idea if its working or not or if my config is correct or not.

Used Alert Generating Rules > Event Base> Generic Text Log (Alert)

Below are the settings:

Did i miss a step somewhere or is my config needs adjustments?

Any help will be appreciated.

Answer 1

Hi

If you definitely have an Alert rule then also, check that you don't already have an alert "somewhere" and the suppression settings. It might be that there is an alert from days ago which you haven't spotted where the repeat count is being incremented and no new alert generated.

Also, there is a water mark and the rule only checks new entries so if you are deleting lines then it might be that the rule isn't going back that far. This is explained here - https://marthijnvanrheenen.wordpress.com/2014/11/08/tips-and-tricks-for-monitoring-log-files-with-system-center-operations-manager/

Kevin Holman walks through this here - https://kevinholman.com/2009/06/19/using-a-generic-text-log-rule-to-monitor-an-ascii-text-file-even-when-the-file-is-a-unc-path/ - double check your steps against this (although it is an old article, it is still accurate today).