Assign Parser Sets
The Assign Parser Sets page creates and edits parser sets and assigns parsers sets to machine IDs. Optionally triggers an alert based on a parser set assignment. A machine ID only displays in the paging area if:
Note: Assigning a parser set to a machine ID on this page activates the log parser. Parsing occurs whenever the log file being parsed is updated.
Note: You can download aPDF from the first topic of online user assistance.
The agent collects log entries and creates an entry in the log monitoring log based on the criteria defined by the parser set, whether or not any of the notification methods are checked. You don't have to be notified each time a new log monitoring entry is created. You can simply review the Log Monitoring log periodically at your convenience.
Parser Definitions and Parser Sets
When configuring Log Monitoring it's helpful to distinguish between two kinds of configuration records: parser definitions and parser sets.
A parser definition is used to:
A parser set subsequently filters the selected data. Based on the values of populated parameters and the criteria you define, a parser set can generate log monitoring entries and optionally trigger alerts.
Without the filtering performed by the parser set, the KServer database would quickly expand. For example a log file parameter called $FileServerCapacity$ might be repeatedly updated with the latest percentage of free space on a file server. Until the free space is less than 20% you may not need to make a record of it in Log Monitoring, nor trigger an alert based on this threshold. Each parser set applies only to the parser definition it was created to filter. Multiple parser sets can be created for each parser definition. Each parser set can trigger a separate alert on each machine ID it is assigned to.
Log Monitoring Setup
To Create a Parser Set Alert
To Cancel a Parser Set Alert
Passing Alert Information to Emails and Procedures
The following types of monitoring alert emails can be sent and formatted:
Note: Changing this email alarm format changes the format for both Assign Parser Sets and Parser Summary emails.
The following variables can be included in your formatted email alerts and in procedures.
If checked and an alarm condition is encountered, an alarm is created. Alarms are displayed in Monitor > Dashboard List, Monitor > Alarm Summary and Info Center > Reports > Logs > Alarm Log.
If checked and an alarm condition is encountered, a ticket is created.
If checked and an alarm condition is encountered, an agent procedure is run. You must click the select agent procedure link to choose an agent procedure to run. You can optionally direct the agent procedure to run on a specified range of machine IDs by clicking this machine ID link. These specified machine IDs do not have to match the machine ID that encountered the alarm condition.
If checked and an alarm condition is encountered, an email is sent to the specified email addresses.
Select Log File Parser
Select a log parser from the Select log file parser drop-down list to display all machine IDs previously assigned this log parser using the Log Parser page.
Define log sets to match
After a log parser is selected, click Edit to define a new parser set or select an existing parser set from the Define log sets to match drop-down list.
Specify the frequency of the parser set condition required to trigger an alert:
Add / Replace
Click the Add or Replace radio options, then click Apply to assign a selected parser set to selected machine IDs.
Click Remove to remove all parser sets from selected machine IDs.
Applies the selected parser set to checked machine IDs.
Clears the assignment of a selected parser set from selected machine IDs.
Clears all parser sets assigned to selected machine IDs.
Select All/Unselect All
Click the Select All link to check all rows on the page. Click the Unselect All link to uncheck all rows on the page.
These icons indicate the agent check-in status of each managed machine. Hovering the cursor over a check-in icon displays the agent quick view window.
Online but waiting for first audit to complete
Agent online and user currently logged on.
Agent online and user currently logged on, but user not active for 10 minutes
Agent is currently offline
Agent has never checked in
Agent is online but remote control has been disabled
The agent has been suspended
The list of Machine.Group IDs displayed is based on the Machine ID / Group ID filter and the machine groups the user is authorized to see using System > User Security > Scopes.
Click the delete icon next to a parser set to delete its assignment to a machine ID.
Log Set Names
Lists the names of parser sets assigned to this machine ID.
The ATSE response code assigned to machine IDs:
A comma separated list of email addresses where notifications are sent.
The interval to wait for the alert event to occur or not occur.
Applies only if Alert when this event occurs <N> times within <N> <periods> is selected. Refers to <N> <periods>.
Applies only if Ignore additional alarms for <N> <periods> is selected.
Topic 3712: Send Feedback. Download a PDF of this online book from the first topic in the table of contents. Print this topic.