org.qbroker.monitor

Class WinlogMonitor

java.lang.Object

org.qbroker.monitor.Monitor

org.qbroker.monitor.WinlogMonitor

All Implemented Interfaces:

java.util.Comparator<int[]>, MonitorAction, MonitorReport

public class WinlogMonitor
extends Monitor
implements java.util.Comparator<int[]>

WinlogMonitor queries Windows Event log and searches for patterns. It relies on an external script to query the Event logs. Currently, we are using extractLog.js to do the job.

Use WinlogMonitor to check Windows Event log repetitively. It runs a predefined JScript to query the Event log with certain selector rules and picks up the newly updated log entries. It guarantees the order and the integrity of the new logs, as long as the query script is well defined and it updates the RecordNumber and TimeGenerated with each query.

In order to keep tracking the RecordNumbers, WinlogMonitor relies on a reference file. The reference file contains the RecordNumber of the reference Event log, its TimeGenerated and the length of the log. A reference Event log is a log entry with valid attributes of RecordNumber and TimeGenerated, and is used as the reference to locate the object log. It may or may not be in the current log stream. The objective log is the first log entry in the current log stream that has either a later TimeGenerated or a larger RecordNumber as compared to those of the reference log. In fact, the object log is the first new log in the current log stream.

Those three parameters are stored in the reference file in the names of position, timestamp and offset. RecordNumber is represented by position. TimeGenerated is repressented by timestamp. The offset is the byte count or length of the reference log.

Here are the rules for the reference file:

(1) If there is the reference file, use it and trust it.
(2) If there is no reference file, use the current time as the timestamp of the reference log and set the position of reference log and the offset to 0.

Author:

yannanlu@yahoo.com

Field Summary

Fields

Modifier and Type	Field and Description
static int	MAXLOGLENGTH
static int	MAXNUMBERLOGS
static int	MAXSCANNEDLOGS

Fields inherited from class org.qbroker.monitor.Monitor

actionCount, actionGroup, aPatternGroup, cachedSkip, category, dependencyGroup, description, disabledWithReport, disableMode, exceptionCount, exceptionTolerance, FILE_SEPARATOR, formatText, keyList, maxPage, maxRetry, name, normalStep, pm, previousStatus, repeatPeriod, report, reportMode, reportName, resolution, serialNumber, site, skip, statsLogger, statusOffset, statusText, step, template, timeFormat, timeTemplate, tolerance, type, xPatternGroup

Fields inherited from interface org.qbroker.monitor.MonitorReport

DISABLED, EXCEPTION, NOSKIP, REPORT_CACHED, REPORT_CLUSTER, REPORT_FINAL, REPORT_FLOW, REPORT_LOCAL, REPORT_NODE, REPORT_NONE, REPORT_SHARED, SKIPPED

Constructor Summary

Constructors

Constructor and Description
WinlogMonitor(java.util.Map props)

Method Summary

Modifier and Type	Method and Description
java.util.Map<java.lang.String,java.lang.Object>	checkpoint() returns the checkpoint Map for the action
int	compare(int[] a, int[] b)
void	destroy() closes and releases all opened resources
protected void	finalize()
java.util.Map<java.lang.String,java.lang.Object>	generateReport(long currentTime) generates a report on a monitored entity and returns it as a Map.
Event	performAction(int status, long currentTime, java.util.Map<java.lang.String,java.lang.Object> latest) examines the report on the monitored entity and reacts to it as an action
void	restoreFromCheckpoint(java.util.Map<java.lang.String,java.lang.Object> chkpt) restores the state of the action from the checkpoint Map

Methods inherited from class org.qbroker.monitor.Monitor

getName, getReportKeys, getReportMode, getReportName, getSkippingStatus, initTimeTemplate, updateContent

Methods inherited from class java.lang.Object

clone, equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface java.util.Comparator

comparing, comparing, comparingDouble, comparingInt, comparingLong, equals, naturalOrder, nullsFirst, nullsLast, reversed, reverseOrder, thenComparing, thenComparing, thenComparing, thenComparingDouble, thenComparingInt, thenComparingLong

Field Detail

MAXNUMBERLOGS

public static final int MAXNUMBERLOGS

See Also:

Constant Field Values

MAXSCANNEDLOGS

public static final int MAXSCANNEDLOGS

See Also:

Constant Field Values

MAXLOGLENGTH

public static final int MAXLOGLENGTH

See Also:

Constant Field Values

Constructor Detail

WinlogMonitor

public WinlogMonitor(java.util.Map props)

Method Detail

generateReport

public java.util.Map<java.lang.String,java.lang.Object> generateReport(long currentTime)
                                                                throws java.io.IOException

Description copied from interface: MonitorReport

generates a report on a monitored entity and returns it as a Map. The report Map will be passed to the associated MonitorAction as an opaque object. The action object is supposed to know how to retrieve the information from the report Map.

Specified by:

generateReport in interface MonitorReport

Specified by:

generateReport in class Monitor

Throws:

java.io.IOException

performAction

public Event performAction(int status,
                           long currentTime,
                           java.util.Map<java.lang.String,java.lang.Object> latest)

Description copied from interface: MonitorAction

examines the report on the monitored entity and reacts to it as an action

Specified by:

performAction in interface MonitorAction

Specified by:

performAction in class Monitor

destroy

public void destroy()

Description copied from interface: MonitorReport

closes and releases all opened resources

Specified by:

destroy in interface MonitorReport

Overrides:

destroy in class Monitor

finalize

protected void finalize()

Overrides:

finalize in class Monitor

checkpoint

public java.util.Map<java.lang.String,java.lang.Object> checkpoint()

Description copied from interface: MonitorAction

returns the checkpoint Map for the action

Specified by:

checkpoint in interface MonitorAction

Overrides:

checkpoint in class Monitor

restoreFromCheckpoint

public void restoreFromCheckpoint(java.util.Map<java.lang.String,java.lang.Object> chkpt)

Description copied from interface: MonitorAction

restores the state of the action from the checkpoint Map

Specified by:

restoreFromCheckpoint in interface MonitorAction

Overrides:

restoreFromCheckpoint in class Monitor

compare

public int compare(int[] a,
                   int[] b)

Specified by:

compare in interface java.util.Comparator<int[]>