topic Re: Simple text log monitoring in Log Analytics

Simple text log monitoring

olegus — Wed, 13 Sep 2023 07:30:52 GMT

I'm new to Dynatrace so bare with my dumb questions here 🙂

What I need is to make Dynatrace to watch a very simple log file in text format , check for a specific value and raise an alert if found.

So far I was able to specify a custom log source under a process that produces my logs but it seems Dynatrace does not want to monitor it. Why is that?

Also , I stumbled across log processing rules and I 'm struggling to create my own to simply find a word sequence there. All examples seems related to known logs from web servers like nginx /haproxy and includes some pretty complex data manipulation. Plus, It seems that logs should be in JSON format? At least that what's required for Rule Testing section..

I have a feeling that I've missing something obvious here - can you point me to the right direction how can I:

- add a text log file to Dynatrace

- add a rule to simply check for words "exit code XXX"

- raise an alert

Re: Simple text log monitoring

natanael_mendes — Wed, 13 Sep 2023 02:51:53 GMT

Hey, you can use some rules to do this.

Check this documentation if you use classic v2

https://www.dynatrace.com/support/help/observe-and-explore/logs/log-monitoring/log-processing

Check this documentation if you use Grail

https://www.dynatrace.com/support/help/observe-and-explore/logs/log-management-and-analytics/lma-use-cases/lma-e2e-set-log-alert

Re: Simple text log monitoring

Mizső — Thu, 14 Sep 2023 13:52:32 GMT

Hi @olegus,

Could you please check my pervious posts about log monitoring.

Solved: List log files for a metric - Dynatrace Community

Solved: Application Log monitoring - Dynatrace Community

As a first step is to set the log collection:

1. At cutom log source configuration you add it manually the test file log

and then

2. At log source configuration if DT recognized your text file log after ponit 1.

It will be also usefull from other members: Solved: Logs Classic - Log storage configuration vs Custom log source - Dynatrace Community

Maybe you can use them.

I hope it helps.

Best regards,

Mizső

Re: Simple text log monitoring

olegus — Thu, 14 Sep 2023 13:56:24 GMT

Thanks, Mizso,

That looks promising, a question regarding switching to Log Monitoring v2 - what will we lose when we switch to v2? We dont monitor any logs yet , but if we do, would we need to redo all log metrics ?

Re: Simple text log monitoring

olegus — Thu, 14 Sep 2023 14:44:13 GMT

Not sure how this forum works, but the first post that was "accepted as a solution" (not by me btw) did not answer my questions - it just contains links to general DT docs, which I already read before asking those questions. I will re-read them and try solutions provided by Mizsco and report back.

Re: Simple text log monitoring

Mizső — Thu, 14 Sep 2023 15:02:15 GMT

Hi @olegus,

I think the answer yes. You will have to redo the log metrics. I was lucky because I switched to v2 quite early I did not have to much v1 configuration. You should do it as soon as possible because as you may read v1 support will end by 01.2024.

Regarding the v1 vs v2. No questions, v2 has much more possibilities than v1. I perfer it.

Best regards,

Mizső

Re: Simple text log monitoring

Mizső — Thu, 14 Sep 2023 15:03:24 GMT

Hi @olegus,

You can accept my answer also. 😉

Thanks in advance.

Best regards,

Mizső

Re: Simple text log monitoring

olegus — Thu, 14 Sep 2023 20:37:20 GMT

Mizso,

1. So far I created Custom Log Source configuration and I also created Log Storage configuration for the same log file - now i see my log in Logs&Events.

2. I've added DQL rule to filter my log data to show only "exit code XXX" lines

3. Looks like I'm good to go to create a Log event.

Re: Simple text log monitoring

sundarv1 — Tue, 09 Apr 2024 12:33:34 GMT

log.source= "/opt/oracle" AND (content="ORA-"). This is log source. instead of searching for content, i want to search ORA- in the first line in the log only. How to do that

Re: Simple text log monitoring

sundarv1 — Sun, 14 Apr 2024 06:53:30 GMT

Hi Mizso

log.source= "/opt/oracle" AND (content="ORA-"). This is log source. instead of searching for content, i want to search ORA- in the first line in the log only. How to do we do that?

Now alerts are generatiing if ORA- is there is any part of content, instead we want to alert generated if ORA- is present in first line.

Re: Simple text log monitoring

sundarv1 — Tue, 16 Apr 2024 06:56:09 GMT

log.source= "/opt/oracle" AND (content="ORA-"). This is log source. instead of searching for content, i want to search ORA- in the first line in the log only. How to do that

Re: Simple text log monitoring

Mizső — Tue, 16 Apr 2024 18:06:46 GMT

Hi @sundarv1,

I do not have solution for your request, maybe other community members have any idea...

Best regards,

Mizső

Re: Simple text log monitoring

sundarv1 — Thu, 18 Apr 2024 11:50:27 GMT

Hi Mizzo

og.source= "/opt/oracle" AND (content="ORA-"). This is log source. instead of searching for content, i want to search ORA- in the first line in the log only. How to do that

Re: Simple text log monitoring

Mizső — Thu, 18 Apr 2024 17:08:28 GMT

Hi @sundarv1,

As I wrote I do not have solution for your request, maybe other community members have any idea...

Best regards,

Mizső

Re: Simple text log monitoring

sundarv1 — Tue, 14 May 2024 04:46:00 GMT

How do we display host IP Address in the Log Monitoring incidents. Currently we are getting Host name only

Thanks

Sundar.v

Re: Simple text log monitoring

sundarv1 — Wed, 10 Jul 2024 15:05:06 GMT

Hi Mizso

How do we map to Servicenow Group to the log monitoring so that incident directly assign to group for log events?