org.qbroker.monitor

Class UnixlogMonitor

java.lang.Object

org.qbroker.monitor.Monitor

org.qbroker.monitor.UnixlogMonitor

All Implemented Interfaces:

MonitorAction, MonitorReport

public class UnixlogMonitor
extends Monitor

UnixlogMonitor monitors a general Unix log file and detects the new occurrences of log entries matching at least one of the given patterns

Use UnixlogMonitor to detect the new occurrence of log entries matching the given patterns. UnixlogMonitor may be repetitively used to check the log file. It will pick up the new log entries only. It also guarantees the order of the occurrences. If a certain log entry appears, the new entry will be stored in the buffer for analysis. The buffer will be updated every time.

UnixlogMonitor can also sum up numbers in the log entries, as long as the pattern contains something like (\d+). Currently, it will process the only one number or less, determined by the attribute of numberDataFields. In default, it is -1, ie, no number to sum. It will use the log buffer and number of logs. If it is set to 0, the sum will be the number of logs.

UnixlogMonitor also has excluding patterns to exclude the special log entries that are not critical. The monitor is fully configurable. The matching events are categoried as INFO, WARNING, ERR and CRIT. WARNING is for small of number matches that is no more than the number of errorIgnored. If the number of match is more than that, the event is CRIT that triggers page alerts. If WARNING persists for more than Tolerence in a row, it will be upgraded to ERR. In case of ERR, the monitor will try to invoke the action scripts if they are defined. If ERR continues and stays the same for more than maxRetry in a row, it will be upgraded to the next level, CRIT.

Sometimes, certain log entries are fatal to the application and require special attentions. For example, OutOfMemoryError requires a restart since the working thread is dead. UnixlogMonitor supports escalation patterns to single out the fatal log entries from the matched log buffer. It allows the end user to set up certain actions in ActionGroup to react on it. In case there is a catch, the event priority will be escalated to ALERT temporarily so that it can trigger the actions on ALERT only. In this case, the value for the attribute of firstEntry will be the first fatal log entry.

UnixlogMonitor supports ExpirationTime. If it is defined and is larger than zero in second, UnixlogMonitor will ignore any new log entry that has a timestamp older than the difference of currentTime - expirationTime. It can be used to skip the old log entries.

Author:

yannanlu@yahoo.com

Field Summary

Fields

Modifier and Type	Field and Description
static int	MAXNUMBERLOGS
static int	MAXSCANNEDLOGS

Fields inherited from class org.qbroker.monitor.Monitor

actionCount, actionGroup, aPatternGroup, cachedSkip, category, dependencyGroup, description, disabledWithReport, disableMode, exceptionCount, exceptionTolerance, FILE_SEPARATOR, formatText, keyList, maxPage, maxRetry, name, normalStep, pm, previousStatus, repeatPeriod, report, reportMode, reportName, resolution, serialNumber, site, skip, statsLogger, statusOffset, statusText, step, template, timeFormat, timeTemplate, tolerance, type, xPatternGroup

Fields inherited from interface org.qbroker.monitor.MonitorReport

DISABLED, EXCEPTION, NOSKIP, REPORT_CACHED, REPORT_CLUSTER, REPORT_FINAL, REPORT_FLOW, REPORT_LOCAL, REPORT_NODE, REPORT_NONE, REPORT_SHARED, SKIPPED

Constructor Summary

Constructors

Constructor and Description
UnixlogMonitor(java.util.Map props)

Method Summary

Modifier and Type	Method and Description
java.util.Map<java.lang.String,java.lang.Object>	checkpoint() returns the checkpoint Map for the action
void	destroy() closes and releases all opened resources
protected void	finalize()
java.util.Map<java.lang.String,java.lang.Object>	generateReport(long currentTime) generates a report on a monitored entity and returns it as a Map.
Event	performAction(int status, long currentTime, java.util.Map<java.lang.String,java.lang.Object> latest) examines the report on the monitored entity and reacts to it as an action
void	restoreFromCheckpoint(java.util.Map<java.lang.String,java.lang.Object> chkpt) restores the state of the action from the checkpoint Map

Methods inherited from class org.qbroker.monitor.Monitor

getName, getReportKeys, getReportMode, getReportName, getSkippingStatus, initTimeTemplate, updateContent

Methods inherited from class java.lang.Object

clone, equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

MAXNUMBERLOGS

public static final int MAXNUMBERLOGS

See Also:

Constant Field Values

MAXSCANNEDLOGS

public static final int MAXSCANNEDLOGS

See Also:

Constant Field Values

Constructor Detail

UnixlogMonitor

public UnixlogMonitor(java.util.Map props)

Method Detail

generateReport

public java.util.Map<java.lang.String,java.lang.Object> generateReport(long currentTime)
                                                                throws java.io.IOException

Description copied from interface: MonitorReport

generates a report on a monitored entity and returns it as a Map. The report Map will be passed to the associated MonitorAction as an opaque object. The action object is supposed to know how to retrieve the information from the report Map.

Specified by:

generateReport in interface MonitorReport

Specified by:

generateReport in class Monitor

Throws:

java.io.IOException

performAction

public Event performAction(int status,
                           long currentTime,
                           java.util.Map<java.lang.String,java.lang.Object> latest)

Description copied from interface: MonitorAction

examines the report on the monitored entity and reacts to it as an action

Specified by:

performAction in interface MonitorAction

Specified by:

performAction in class Monitor

checkpoint

public java.util.Map<java.lang.String,java.lang.Object> checkpoint()

Description copied from interface: MonitorAction

returns the checkpoint Map for the action

Specified by:

checkpoint in interface MonitorAction

Overrides:

checkpoint in class Monitor

restoreFromCheckpoint

public void restoreFromCheckpoint(java.util.Map<java.lang.String,java.lang.Object> chkpt)

Description copied from interface: MonitorAction

restores the state of the action from the checkpoint Map

Specified by:

restoreFromCheckpoint in interface MonitorAction

Overrides:

restoreFromCheckpoint in class Monitor

destroy

public void destroy()

Description copied from interface: MonitorReport

closes and releases all opened resources

Specified by:

destroy in interface MonitorReport

Overrides:

destroy in class Monitor

finalize

protected void finalize()

Overrides:

finalize in class Monitor