Forum Discussion

Mosh's avatar
Mosh
Icon for Professor rankProfessor
7 years ago

Triggers in logfile event sources not working as expected

Hello community,

I have a logfile monitoring eventsource and the event source has one trigger defined to match on the string "Issue". 

The logfile is updated with errors routinely.  I want to alert on any line with the string "Issue" in it.  Here are the sample lines from the log file:

2018-02-27T16:34:02.195414+00:00 wklxpsynrts01 Batch Job Check: Issue: Executed from impurgeBatch, Process is stuck. On the server: wklxpsynrts01 for country: uk at: 2018-02-16 10:56:57
2018-02-27T16:35:02.031109+00:00 wklxpsynrts01 Batch Job Check: Issue: Executed from pnolBatch, Process is stuck or not running. On the server: wklxpsynrts01 for country: uk at: 2018-02-16 10:56:57
2018-02-27T16:36:02.246570+00:00 wklxpsynrts01 Batch Job Check: Issue: Executed from exportBatch, Process is stuck or not running. On the server: wklxpsynrts01 for country: uk at: 2018-02-16 10:56:57
2018-02-27T16:37:02.035509+00:00 wklxpsynrts01 Batch Job Check: Issue: Executed from importBatch, Import failed. On the server: wklxpsynrts01 for country: uk at: 2018-02-16 10:56:57

I would expect this to generate four alerts, one alert for each line that matched the trigger expression, but it seems to stop after the first match.  This looks like a bug to me, can anyone from LM confirm please?

  • Mosh's avatar
    Mosh
    Icon for Professor rankProfessor
    7 years ago

    Answered.

    I've had a response back from developers that this is working as designed because LogicMonitor is not intended to be used as a logging output collector.  Our workaround is to define specific regular expressions for the log messages for which we want to generate alerts.