org.qbroker.monitor

Class ExpectedLog

java.lang.Object

org.qbroker.monitor.Monitor

org.qbroker.monitor.ExpectedLog

All Implemented Interfaces:

MonitorAction, MonitorReport

public class ExpectedLog
extends Monitor

ExpectedLog monitors a generic Unix log file and expects new log entries with certain patterns showing up frequently. In case it fails to find those log entries within a certain period, ExpectedLog treats the log late and raises alerts.

Use ExpectedLog to detect the new occurrence of log entries matching one of the given patterns. ExpectedLog may be repetitively used to check the log file. It will pick up the new log entries only. It also guarantees the order of the occurrences. If a certain log entry appears, the new entry will be stored in the buffer for analysis. The buffer will be updated every time.

ExpectedLog supports excluding patterns to exclude the certain log entries that are not interesting. The monitor is fully configurable. In case it fails to find any log to match the predefined patterns, it will use the previous timestamp for evaluations. If ExpectedLog finds no match at the start up, the monitor will disable itself for only once to delay the evaluations. If there is still no log found next time, the default timestamp of the log file will be used for evaluations.

ExpectedLog also supports time correlations and size correlations between the reference file and the log entries that match to the patterns. The reference file controls the correlation process. Whenever the reference file is updated or modified, ExpectedLog adjusts its timer and correlates this change with the target log entries. If the log has any new target log entries as expected, the ExpectedLog treats it OK. Otherwise, it will send alerts according to the predefined tolerance on the lateness of the target logs.

In order to configure ExpectedLog to do time correlations, you have to specify a map named reference in its property hash. The reference map contains most of the properties required by a FileMonitor object, such as Filename, Name, etc. The tolerance of the lateness will be controlled by the threshold parameters. In fact, ExpectedLog will create a separate instance for the reference file. The method of performAction() will actually do the time correlations between two objects.

In case of the size correlations, you must specify the triggerSize in the property map. The triggerSize is zero or any positive number that defines two different states, on and off. In on state, the size of the reference file is no less than the triggerSize. In off state, the size of the reference file is less than the triggerSize and the monitor is in Blackout state. Therefore, the size of the reference file acts like a switch.

Author:

yannanlu@yahoo.com

Field Summary

Fields

Modifier and Type	Field and Description
static int	MAXNUMBERLOGS
static int	MAXSCANNEDLOGS

Fields inherited from class org.qbroker.monitor.Monitor

actionCount, actionGroup, aPatternGroup, cachedSkip, category, dependencyGroup, description, disabledWithReport, disableMode, exceptionCount, exceptionTolerance, FILE_SEPARATOR, formatText, keyList, maxPage, maxRetry, name, normalStep, pm, previousStatus, repeatPeriod, report, reportMode, reportName, resolution, serialNumber, site, skip, statsLogger, statusOffset, statusText, step, template, timeFormat, timeTemplate, tolerance, type, xPatternGroup

Fields inherited from interface org.qbroker.monitor.MonitorReport

DISABLED, EXCEPTION, NOSKIP, REPORT_CACHED, REPORT_CLUSTER, REPORT_FINAL, REPORT_FLOW, REPORT_LOCAL, REPORT_NODE, REPORT_NONE, REPORT_SHARED, SKIPPED

Constructor Summary

Constructors

Constructor and Description
ExpectedLog(java.util.Map props)

Method Summary

Modifier and Type	Method and Description
java.util.Map<java.lang.String,java.lang.Object>	checkpoint() returns the checkpoint Map for the action
void	destroy() closes and releases all opened resources
protected void	finalize()
java.util.Map<java.lang.String,java.lang.Object>	generateReport(long currentTime) generates a report on a monitored entity and returns it as a Map.
Event	performAction(int status, long currentTime, java.util.Map<java.lang.String,java.lang.Object> latest) examines the report on the monitored entity and reacts to it as an action
void	restoreFromCheckpoint(java.util.Map<java.lang.String,java.lang.Object> chkpt) restores the state of the action from the checkpoint Map

Methods inherited from class org.qbroker.monitor.Monitor

getName, getReportKeys, getReportMode, getReportName, getSkippingStatus, initTimeTemplate, updateContent

Methods inherited from class java.lang.Object

clone, equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

MAXNUMBERLOGS

public static final int MAXNUMBERLOGS

See Also:

Constant Field Values

MAXSCANNEDLOGS

public static final int MAXSCANNEDLOGS

See Also:

Constant Field Values

Constructor Detail

ExpectedLog

public ExpectedLog(java.util.Map props)

Method Detail

generateReport

public java.util.Map<java.lang.String,java.lang.Object> generateReport(long currentTime)
                                                                throws java.io.IOException

Description copied from interface: MonitorReport

generates a report on a monitored entity and returns it as a Map. The report Map will be passed to the associated MonitorAction as an opaque object. The action object is supposed to know how to retrieve the information from the report Map.

Specified by:

generateReport in interface MonitorReport

Specified by:

generateReport in class Monitor

Throws:

java.io.IOException

performAction

public Event performAction(int status,
                           long currentTime,
                           java.util.Map<java.lang.String,java.lang.Object> latest)

Description copied from interface: MonitorAction

examines the report on the monitored entity and reacts to it as an action

Specified by:

performAction in interface MonitorAction

Specified by:

performAction in class Monitor

checkpoint

public java.util.Map<java.lang.String,java.lang.Object> checkpoint()

Description copied from interface: MonitorAction

returns the checkpoint Map for the action

Specified by:

checkpoint in interface MonitorAction

Overrides:

checkpoint in class Monitor

restoreFromCheckpoint

public void restoreFromCheckpoint(java.util.Map<java.lang.String,java.lang.Object> chkpt)

Description copied from interface: MonitorAction

restores the state of the action from the checkpoint Map

Specified by:

restoreFromCheckpoint in interface MonitorAction

Overrides:

restoreFromCheckpoint in class Monitor

destroy

public void destroy()

Description copied from interface: MonitorReport

closes and releases all opened resources

Specified by:

destroy in interface MonitorReport

Overrides:

destroy in class Monitor

finalize

protected void finalize()

Overrides:

finalize in class Monitor