NiCE Log File Management Pack. for. System Center Operations Manager Quick Start Guide

Transcription

1 NiCE Log File Management Pack for System Center Operations Manager 2012 Version 1.30 March 2015 Quick Start Guide

2 Legal Notices NiCE IT Management Solutions GmbH makes no warranty of any kind with regard to this manual, including, but not limited to, the implied warranties of merchantability and fitness for a particular purpose. NiCE shall not be held liable for errors contained herein or direct, indirect, special, incidental or consequential damages in connection with the furnishing, performance, or use of this material. Restricted Rights Legend All rights are reserved. No part of this document may be photocopied, reproduced, or translated to another language without the prior written consent of NiCE IT Management Solutions GmbH. The information contained in this document is subject to change without notice. Copyright Notices Copyright 2015 by NiCE IT Management Solutions GmbH, Germany. All rights reserved. Reproduction, adaptation, or translation of this document without prior written permission is prohibited, except as allowed under the copyright laws. Trademark Notices Microsoft, Windows, and Windows NT are U.S. registered trademarks of Microsoft Corporation. UNIX is a registered trademark of The Open Group. Enterprise Server is a trademark of Research In Motion (RIM ) Corporation. All other product names are the property of their respective trademark or service mark holders and are hereby acknowledged. The version number on the title page of this document indicates software version. The print date on the title page changes each time this document is updated. You will receive updated or new editions if you subscribe to the appropriate product support service. NiCE Log File MP Quick Start Guide Page 2 of 38

3 Contents Legal Notices Contents Introduction Before you Start Supported Environments Limitations Known issues Prerequisites Installing the NiCE Log File MP Install the Log File MP Setup Package Import the Management Pack Bundle Using the NiCE Log File MP Important Information Self-Monitoring Create a Log File Monitor/Rule Create an Alert Rule Create a 2-State Monitor Create an Advanced Performance Rule Reference Regular Expression (Regex) Regular Expression Matches, Groups and Captures XPath Available XPath in Log File Provider NiCE LogFileMonitoring DataItem example Read Mode Troubleshooting Logging Tracing Enabling using override Enabling using file Removing the NiCE Log File MP Remove the Log File MP Remove the Log File MP Installation Package NiCE Log File MP Quick Start Guide Page 3 of 38

4 Introduction The NiCE Log File Management Pack is an extension for Microsoft System Center Operations Manager 2012 and 2012 R2. The NiCE Log File MP enables you to create rules and monitors via the user interface (UI) so that you can monitor log files with the NiCE Log File Provider. The information provided in this guide shows you how to install the software and make one or two recommended adjustments for your monitoring landscape. You can use the Quick Start Guide to help you perform basic troubleshooting activities, for example, to enable or disable logging and tracing, and maintain the log and trace files. Last but not least, the Quick Start Guide shows you how to remove the NiCE Log File management pack quickly and cleanly. Before you start the installation process, read the important information concerning prerequisites, supported platforms, and limitations included in Before you Start. NiCE Log File MP Quick Start Guide Page 4 of 38

5 Before you Start This guide explains how to install and setup the NiCE Log File MP. Before you start the installation and configuration process, have a look at the information in this section, which covers the following areas: Supported Environments Limitations Supported Environments The NiCE Log File MP supports the following platforms and applications: System Center Operations Manager 2012, 2012 SP1, 2012 R2 have been verified and approved for production use. Limitations The NiCE Log File MP has the following known limitations: Only supported on Microsoft Windows Servers. Monitoring the same log file via different management groups might not work correctly (multi-homing) NiCE Log File MP Quick Start Guide Page 5 of 38

6 Prerequisites If you want to install and run the NiCE Log File MP, note the following prerequisites: You have System Center Operations Manager authoring experience.net 2.0 SP1 must already be installed on all systems that are monitored You have experience in regular expressions and XPath (recommended) The latest update for SCOM 2012 is installed (recommended) NiCE Log File MP Quick Start Guide Page 6 of 38

7 Installing the NiCE Log File MP To complete the installation process for the NiCE Log File MP, you must perform the steps: 1. Install the Log File MP Setup Package 2. Import the Management Pack Install the Log File MP Setup Package You perform this installation step on the Ops Mgr Management Server system or any other Windows server or computer. It is recommended to install the setup MSI on a Management Server to have the setup package in a central location. It is also recommended to use the %programfiles% directory to install the NiCE Log File MP. 1. Copy the Microsoft installation package for the Log File MP (NiCE_LogFileMP_0130.msi) to a temporary location on the OpsMgr Server. 2. Double-click the file NiCE_LogFileMP_0130.msi to start the installation process. 3. Follow the instructions displayed in the setup screens and dialogs. The Setup MSI package NiCE_LogFileMP_0130.msi serves as a container and only has the management pack bundle file. Import the Management Pack Bundle You perform this installation step on the OM Administration Console. 1. Log on to the Administration Console and import the following management-pack files: NiCE.LogFile.Library.mpb By default, the management-pack files are located in the folder %ProgramFiles(x86)%\NiCE\LogfileMP\MPs on the system where the setup package was installed, NiCE Log File MP Quick Start Guide Page 7 of 38

8 Using the NiCE Log File MP This section explains how to create a monitor or rule to use the NiCE log file provider. Due to the extensive variety of wizards this section does not explain every wizard that exists in the Management Pack. If you are not familiar with regular expression or XPath, you can find more details in the sections Regular Expression (Regex) and XPath. Dialogs often also contain i (information) icons which display help text when you hover your mouse over the icon. Important Information The default polling interval of the log file provider is 60 seconds; this interval can be changed in the pre-process settings. Command, working directory, arguments, log file paths and log file names can contain environment variables, for example, %temp%. Self-Monitoring All important internal states and messages from the log file provider are written to the Operations Manager Event Log. For error and warning events, self-monitoring is available in the Management Pack and shown as alerts in the Active Alerts view. The self-monitoring rules are targeting Windows Computer but are disabled by default. It is recommend to enable self-monitoring only for the monitored systems. Create a Log File Monitor/Rule All log file wizards can be found in the following locations in the UI: Operations Console -> Authoring -> Management Pack Objects -> Rules -> Create a new rule... -> NiCE Log Files Operations Console -> Authoring -> Management Pack Objects -> Monitors -> Create a Monitor -> NiCE Log Files NiCE Log File MP Quick Start Guide Page 8 of 38

9 Create an Alert Rule To create a log file rule using the rule-creation wizard, you must define the following details: Set the Rule Type Define General Rule Properties Specify the Log File Source Configure the Alert Details Set the Rule Type 1. In the Create a Rule wizard, select the Alert Rule type in the NiCE Log Files folder 2. Select an existing management pack to save the new rule or create a new management pack folder. 3. Click Next to proceed. NiCE Log File MP Quick Start Guide Page 9 of 38

10 Create a Rule Wizard Define General Rule Properties 1. On the general properties page enter the Name for the new rule in the Rule Name box. You can also type in an optional Description of the new rule. 2. Select a Rule Category from the drop-down list, for example, Alert. 3. Select a Rule Target. Any rule target that exists on a Windows computer is supported. 4. Press Next to proceed NiCE Log File MP Quick Start Guide Page 10 of 38

11 . General Properties NiCE Log File MP Quick Start Guide Page 11 of 38

12 Specify the Log File Source In the rule-creation wizard for log files, the main location for defining setup details is the Log File Source page. 1. Enter the Log file path where the log file is located 2. Enter the Log file name. It is also supported when you use the target properties via the > button. The log file name can be entered as an absolute path and supports wildcards. If an absolute path is provided in the Log file name field, it is not required to enter the path in the log file path field. 3. The NiCE Log File MP also supports regular expressions to filter log files. In the example illustrated, we specify error for the filter regex pattern to ensure only log file entries that contain an error will create an alert. NiCE Log File MP Quick Start Guide Page 12 of 38

13 4. Click Next to proceed. NiCE Log File MP Quick Start Guide Page 13 of 38

14 Configure the Alert Details 1. On the Configure Alerts page specify the Alert name and an Alert description. 2. Set the alert priority. The Priority can be set to one of the following: Low, Medium or High. 3. Set the alert severity. The Severity can be set to one of the following: Information, Warning or Critical (Error). 4. Specify if you want to enable alert suppression. The Alert Suppression option enables you to suppress duplicate alerts and adds a repeat counter to the alert. 5. When everything is set up, click Create to create the new rule. Note Values from the log file provider can be specified by using the syntax rule $Data/XPATH$ E.g. $Data/LogFileLine$, $Data/LogFileName$ NiCE Log File MP Quick Start Guide Page 14 of 38

15 Create a 2-State Monitor To create a log file monitor using the monitor-creation wizard, you must define the following details: Set the Monitor Type Define General Monitor Properties Specify the Log File Source Define the Healthy Expression Filter Define the Warning/Critical Expression Filter Configure the Monitor Health Configure the Monitor Alert Set the Monitor Type 1. In the Create a Monitor Wizard select the 2-State Monitor in the NiCE Log Files folder. 2. Select an existing management pack to save the new monitor or create a new management pack. 3. Click Next to proceed. Select a Monitor Type NiCE Log File MP Quick Start Guide Page 15 of 38

16 Define General Monitor Properties 1. On the General Properties page enter the Name and Description for the new monitor. 2. Select a Monitor Target. Any Target that exists on a Windows computer is supported. 3. Specify the Parent monitor. The Parent monitor may be set to one of Availability, Performance or Configuration. 4. Click Next to proceed. NiCE Log File MP Quick Start Guide Page 16 of 38

17 Specify the Log File Source This is the main page to specify the log file source settings. 1. Enter the Log file path where the log file is located 2. Enter the Log file name. The log file name can be entered as an absolute path and supports wildcards. If an absolute path is provided, it is not required to enter the path in the log file path field. 3. Define a filter for log-file entries. The NiCE Log File MP supports regular expressions to filter log file entries and choosing target properties via the > buttons on this page. 4. Click Next to proceed. NiCE Log File MP Quick Start Guide Page 17 of 38

18 Define the Healthy Expression Filter Specify when the monitor should have a green (healthy) indicator on this page. 1. Create an empty expression by clicking the insert button. 2. Enter values for the parameter Name, the Operator and the expected Value, for example: LogFileLine - Contains - SRPConnect Test: Test connection to Relay was successful The following parameters are available for selection as the Parameter Name: LogFileLine LogFileName FullPath LogFileDirectory If a regular expression was used when defining the log file source in the Log File Source dialog, more parameters are available. The parameters are based on the regular expression used, for example: ^\[(?<errorcode>\d*)\]\s\((?<date>.+?)\):{.*?}\s(?<message>.*)$) RegexMatch/errorcode RegexMatch/date RegexMatch/message Note that the Parameter Name is case sensitive. 3. Set the operator to apply in the filter. In this example, the operator Contains checks if the log file entry contains the specified value SRPConnect Test: Test connection to Relay was successful. 4. Press Next to proceed. NiCE Log File MP Quick Start Guide Page 18 of 38

19 Define the Warning/Critical Expression Filter The steps required to configure a Warning/Critical Expression Filter are essentially the same as those required for setting up a Healthy Expression Filter. 1. Create an empty expression by clicking the insert button. 2. Enter values for the parameter Name, the Operator and the expected Value, for example: LogFileLine - Contains - Failed 3. Specify when the monitor should show Warning or Critical alerts. It is possible to combine several conditions by grouping them together with a logical And or Or. 4. Press Next to proceed. Configure the Monitor Health State In this step you map the monitor conditions (healthy, warning, critical) to a heath state (healthy, warning, critical). 1. Specify the Health State (healthy, warning, ) for the monitor conditions that were defined in the expression filter pages of the monitor setup wizard. 2. One of the monitor conditions needs to have Healthy as its health state; the other monitor condition can be set to Warning or Critical as required. 3. Press Next to proceed. NiCE Log File MP Quick Start Guide Page 1 of 38

20 Configure the Monitor Alerts In this section, we specify if the monitor should create an alert when the monitor switches to the warning/critical state. 1. Set the alert priority The Priority can be set to one of the following: Low, Medium or High. 2. Set the alert severity The Severity can be set to one of the following: Information, Warning, Critical (Error) or even match monitor health. 3. When everything is set up, click Create to create the new monitor alert. Note Values from the log file provider can be used by using the syntax rule $Data/Context/XPATH$ E.g. $Data/Context/LogFileLine$, $Data/Context/LogFileName$ NiCE Log File MP Quick Start Guide Page 2 of 38

21 Create an Advanced Performance Rule To create an Advanced Performance Rule in this example, we show how to create a performance rule which performs the following actions: 1. Pings a computer 2. Triggers the writing of information into a log file that is read by the NiCE log file provider 3. Creates performance data. You use the Create Rule Wizard to perform the steps required to create an advanced performance rule, as described in the following sections. Rules Type 1. In Rule Type dialog of the Create a Rule Wizard, select the Performance Rule -> Advanced->Performance Rule (Advanced, Optimized Collection) type in the NiCE Log Files folder 2. Select the Management Pack where you want to save the new rule or create a new one. NiCE Log File MP Quick Start Guide Page 3 of 38

22 General Properties 1. In the General dialog of the Create Rule wizard, enter a Name and Description for the new rule. 2. Select a Rule target. Any target that exists on a Windows computer is supported. 3. Click Next to proceed. General Properties NiCE Log File MP Quick Start Guide Page 4 of 38

23 Preprocessing Settings 1. Use the Preprocessing Settings dialog to specify a command or a program that must be started before the read operation of the log file begins. 2. You can also supply arguments and options for the command 3. Specify an optional schedule at which the command or program should run 4. Define any environment variables that are required to run the specified command. 5. Click Next to proceed. NiCE Log File MP Quick Start Guide Page 5 of 38

24 Log File Source This is the main page to setup the Log file source settings. 1. Enter the path to the location of the log file. You can leave the Log file name box empty, if you supply an absolute path as part of the file name in the Log file name box. 2. Enter the name of the log file. The log file name can be entered as an absolute path and can contain characters defined using wildcards. If an absolute path is provided, it is not required to enter the path in the log file path field. The Log file name box also supports filenames specified using regular expressions 3. Specify the Read Mode. In this case, we set the Read Mode to Read from beginning (Always) because the file will be generated every time the ping command is executed. 4. Click Next to proceed. NiCE Log File MP Quick Start Guide Page 6 of 38

25 Regular Expression Settings Regular expressions (regex) can be used to filter the log file entries, split them into regex groups, and create new text by using regex replace. Note Split regex is only required when filter regex is not used or is different from the filter regex. Regex replace only works if filter and/or split regex is specified. We are interested at the summary of the ping command. An example of the output is: Minimum = 16ms, Maximum = 16ms, Average = 16ms To get the minimum, maximum, and average times (in milliseconds) we use the following regular expression:.*minimum = (?<MINIMUM>\d+)ms.+Maximum = (?<MAXIMUM>\d+)ms.+Average = (?<AVERAGE>\d+)ms NiCE Log File MP Quick Start Guide Page 7 of 38

26 Regular Expression Tester The Regular Expression Settings Dialog includes the Regex Testing Tool, which enables you to test a regular expression string. With the Regex Testing Tool, you can open a log file or create and verify an example log file entry to ensure that the specified regular expression is working correctly. NiCE Log File MP Quick Start Guide Page 8 of 38

27 Performance Mapper The Performance Mapper Dialog enables you to specify the options for mapping the log file entries to performance data. 1. In the Object, Counter, and Instance fields, any text or target value can be specified. 2. In the Value field, in this example we use the AVERAGE regex group, which is provided by the log file provider based on the regex specified previously. 3. Press Next to proceed. NiCE Log File MP Quick Start Guide Page 9 of 38

28 Optimized Collection The Optimized Collection dialog can be used to reduce the amount of data that is analyzed and stored. When everything is set up, click the Create button to create the new performance rule. NiCE Log File MP Quick Start Guide Page 10 of 38

29 Reference Regular Expression (Regex) In some of the wizard dialogs, regular expression can be used to improve the performance of the log file provider. If the regular expression is applied to a log file entry, regular expression matches, groups, and captures are created. Here is a short overview of commonly used elements of the regular expression language. Character Description Regex Meaning. Dot Match a single character * Asterisk Match the previous zero or more time + Plus sign Match the previous one or more time? Question mark Match the previous zero or one time () Brackets Group (?<Name>) Named group ^ Caret Beginning of line $ Dollar sign End of line \w Backslash w Match word character \W Backslash W Match non-word character \s Backslash s Match whitespace character \S Backslash S Match non-whitespace character \d Backslash d Match decimal character \D Backslash D Match non-decimal character [] Square brackets Group of characters [^] Negated group of characters \ Backslash Escape special characters such as. (dot) or \ (backslash). Example: \. or \\ There is much more information available about regular expression on the following page: NiCE Log File MP Quick Start Guide Page 11 of 38

30 Regular Expression Matches, Groups and Captures Regular expression match A regular expression match is created when the regular expression pattern is applied to the specified text. It contains the entire text that matches the regular expression. This could be the entire log file entry or a part of it. There could also be zero or more matches and it can contain groups and captures. Example 1: Text: abcabcabc Regular expression pattern: abc This will create 3 matches of abc Example 2: Text: abcabcabc Regular expression pattern: [abc]+ This will create 1 matches of abcabcabc Regular expression group A regular expression group is a subset of the regex pattern. It can be used to get some parts from the log file entry. E.g. only the error message is required from the entry. The existing unnamed groups () and named groups (?<name>). Example 1: Text: abcabcabc Regular expression pattern: (abc+) This will create 3 match with 1 group of abc each match Example 2: Text: :00 Regular expression pattern: (?<date>\d\d\d\d-\d\d-\d\d)\s(?<time>\d\d:\d\d) This will create 1 match with a name group date with the value and a named group time with the value 12:00 Regular expression capture A regular expression group can also have one or more captures. There is always one capture which contains the value of the entire match. Example 1: Text: abcabcabc Regular expression pattern: (abc)+ This will create 1 match with 1 group and 3 captures of abc Example 2: Text: a123b456 Regular expression pattern: a(?<digit>\d)+ b(?<digit>\d)+ This will create 2 match with 1 group and 3 different captures of for the first match and for the second one. Links The following links contain more information about regular expression and the used regular expression operations: Regular Expression Language: NiCE Log File MP Quick Start Guide Page 12 of 38

31 Substitutions Language (regex replace): Regular Expression examples: Regular Expression (programmatically): XPath On Expression Filter or Alert dialogs, it is mandatory to use XPath to access the data provided by the log file provider. On expression filter dialogs, the XPath can be used directly. Example: On alert dialogs or other dialog pages, it is mandatory to add the string $Data/ in front of the XPath and the dollar character $ at the end. For more information about syntax rules, see Example: LogFileLine in expression filter, $Data/LogFileLine$ in the Rule Alert dialog, $Data/Context/LogFileLine$ in the Monitor Alert dialog. This XPath is dependent on the type of data item (DataItem). LogFileMonitoringDataItem System.CorrelatorData with 2 LogFileMonitoringDataItem NiCE Log File MP Quick Start Guide Page 13 of 38

32 Available XPath in Log File Provider In the log file provider, the following XPath is available for usage. Note XPath is case sensitive. This XPath is always available: The folder where the log file is located: The name of the log file: The folder and name of the log file: The log file entry which was read: LogFileDirectory LogFileName FullPath LogFileLine Note The folder will be an absolute path. If environment variables like %temp% are used, the folder will be as example C:\Windows\Temp. If a regular expression is used there is more XPath available. If a single match, group, or capture is present, a shorter version of XPath can be used. Unnamed groups are available as Group1 n. Note Group0 contains the entire match and is always present. For a single match: RegexMatch Or RegexMatch/Group0/Capture For multiple matches: RegexMatch[1] (for the first match) RegexMatch[2] (for the second match) Or RegexMatch[1]/Group0/Capture For a match with named group: //NameOfGroup Or RegexMatch/NameOfGroup Or RegexMatch/NameOfGroup/Capture NiCE Log File MP Quick Start Guide Page 14 of 38

33 For multiple captures: RegexMatch/Group1/Capture[1] RegexMatch/Group1/Capture[2] (for the first capture) (for the second capture) This can all be combined: RegexMatch[3]/NameOfGroup/Capture[5] The third match of the group named NameOfGroup and the fifth capture of this group. Regex replace: If Regex replace is used, the result can be found under RegexMatch/RegexReplaced: RegexMatch/RegexReplaced[1] (for the first used regex replace) RegexMatch/RegexReplaced[2] (for the second used regex replace) Note Regex replaces operations only using the last capture of a group and every match separately. Example: Text: a123b456 Regular Expression: a(?<digit>\d)+ b(?<digit>\d)+ Regex Replace: ${digit} Result: One RegexMatch[1]/RegexReplaced with the value of 3 and one RegexMatch[2]/RegexReplaced with the value of 6. NiCE Log File MP Quick Start Guide Page 15 of 38

34 NiCE LogFileMonitoring DataItem example <DataItem type="nice.logfilemonitoringdataitem" > <LogFileDirectory> </LogFileDirectory> <LogFileName> </LogFileName> <FullPath> </FullPath> <LogFileLine> </LogFileLine> <RegexMatch> <Group0> <Capture> </ Capture > </Group0> <NamedGroup> <Capture> </ Capture > <Capture> </ Capture >... </NamedGroup>... <RegexReplaced> </RegexReplaced> <RegexReplaced> </RegexReplaced>... </RegexMatch> <RegexMatch>... </RegexMatch> </DataItem> NiCE Log File MP Quick Start Guide Page 16 of 38

35 Read Mode On all read modes, the log files are read from the start or the last known position. The start position is dependent on the selected read mode. If the log file is deleted, the file size reduced, or some other changes occur, the read position can change. The last position will also remain known during System Center Operations Manager Agent restart or crashes. Read Mode Read from begin/end (Default) Read from beginning (Always) Read log file from end Description This mode is dependent on the file size. For log files that are smaller than 200 KB, the log file provider will start reading from the beginning, otherwise it will read from the end. If the file size is decreasing or the last read line didn't match, the provider will read from begin or end depending on the file size. If the file was deleted or creation date changed, the provider will read the entire file from beginning. The log file provider will read the entire file always from beginning. If the file size is decreasing or the last read line didn't match, the provider will read the file from end. If the file was deleted or creation date changed, the provider will read the entire file from beginning. NiCE Log File MP Quick Start Guide Page 17 of 38

36 Troubleshooting The troubleshooting chapter contains information covering the following areas: Logging Tracing Logging All important internal states and messages from the log file provider are written to the Operations Manager Event Log. For error and warning events, self-monitoring is available in the Management Pack and shown as alerts in the Active Alerts view. Tracing The NiCE Log File can be enabled by two types: Enabling using override Enabling using file The information written to the trace files is designed to help the support teams to pinpoint and solve problems as quickly and efficiently as possible. The Trace file will be written to the temp folder from the user which is used for SCOM agent. If the SCOM Agent runs under Local System, the Temp Directory will be C:\Windows\Temp. Note Tracing can produce large amounts of data in the trace file, and there is no file-size limitation for this feature. You should use tracing only if support asks you to do so. If you do enable tracing, make sure that tracing is switched off again after the targeted events have been triggered and the tracing actions finished. Enabling using override Rules or monitors created for the log file provider contain a parameter named Tracing, which must be set to true, for example, by using an override. The Tracing parameter only enables tracing for the rule or monitor in which it is set. NiCE Log File MP Quick Start Guide Page 18 of 38

37 Enabling using file To enable tracing, create the file _spi.cfg in the %windir%/temp directory and insert the following content: SPI_TRACE_STATUS ON SPI_TRACE_PROCESS LogFileProvider NiCE Log File MP Quick Start Guide Page 19 of 38

38 Removing the NiCE Log File MP The following steps need to be performed: 1. Remove the Log File MP 2. Remove the Log File MP Installation Package Remove the Log File MP Perform this operation with the OpsMgr Administration Console. Delete the NiCE Log File MP Management pack and all dependent MPs from the OpsMgr Server in the Administration Console. Remove the Log File MP Installation Package Perform this step on each of the OpsMgr server where you installed the Log File MP package. 1. Use the Add/Remove Programs tool provided by the operating system and remove NiCE Log File MP entry.. NiCE Log File MP Quick Start Guide Page 20 of 38