topic Re: Log monitor Extension in Splunk AppDynamics

Log monitor Extension

Dean_Moses — Tue, 15 Aug 2017 12:01:07 GMT

Hi there! I would like to know if there is perhaps a way to escape special characters inside the string pattern of the log monitor. Example:

"...searchStrings:
#displayName Should be unique across the patterns including the case.

- displayName: "DynamicErrorCodes"
pattern: "<ns0':'ResultMsgCode>.*?</ns0':'ResultMsgCode>"
matchExactString: false
caseSensitive: false..."

It seems as though the special character, in this case, is the ":" inside the "<ns0':'ResultMsgCode>..." part. I have tried using \\; ''; and ". The issue with this is that in appD it only shows the "<ns0" when it should display the entire string. I have attached a screenshot of the result in the attached pdf. Please assist?

Regards,

Dean

Re: Log monitor Extension

Satish_Muddam1 — Thu, 17 Aug 2017 06:24:38 GMT

Hi Dean,

MachineAgent uses ":" to separate metric names and values and this is the reason you are not seeing the whole string in the metric name. Try using "metricCharacterReplacer" config option to replace ":" with some other character. You can find a sample config at https://github.com/Appdynamics/log-monitoring-extension/blob/master/src/main/resources/conf/config.yaml.

Please create a help desk ticket (help@appdynamics.com ) with MachineAgent debug logs if this does not solve the problem.

Thanks,

Satish M

Re: Log monitor Extension

Dean_Moses — Thu, 17 Aug 2017 07:17:51 GMT

Hi Satish,
This looks very promising thanks, will test and advise. Greatly appreciated thanks!
Regards,
Dean

Re: Log monitor Extension

Dean_Moses — Thu, 17 Aug 2017 09:31:02 GMT

Hi,

Did some more digging, according to yaml.org this seems to be a limitation:

http://yaml.org/spec/1.2/spec.html#id2795688

“…Inside literal scalars, all (indented) characters are considered to be content, including white space characters. Note that all line break characters are normalized. In addition, empty lines are not folded, though final line breaks and trailing empty lines are chomped.

There is no way to escape characters inside literal scalars. This restricts them to printable characters. In addition, there is no way to break a long literal line.

[171]	l-nb-literal-text(n)	::=	l-empty(n,block-in)* s-indent(n) nb-char+
[172]	b-nb-literal-next(n)	::=	b-as-line-feed l-nb-literal-text(n)
[173]	l-literal-content(n,t)	::=	( l-nb-literal-text(n) b-nb-literal-next(n)* b-chomped-last(t) )? l-chomped-empty(n,t)

Tried using “\” but this breaks the logmonitor:

“…[Agent-Monitor-Scheduler-4] 17 Aug 2017 10:34:32,506 ERROR LogMonitor - Unfortunately an issue has occurred:

while scanning a quoted scalar

in 'reader', line 24, column 19:

pattern: '<ns0\:ResultMsgCode>.*?</ns0\:R ...

found the unexpected end of stream

in 'reader', line 44, column 1:…”

Tried it in single quotes as well as no quotes and this chops the rest of the string off as it does with double-quotes. Replacing special characters seems to be the best method, many thanks for your assistance Satish 🙂

Regards,

Dean