About saad

saad · ‎10-17-2022

Hello Everyone, Recently I got to know about a feature in AppDynamics where we can trigger scripts on a HR violation. I am really excited to use this functionality for our project. I am looking for some real time use cases where this has been implemented and has resolved a great problem. 1. Currently I have written a script where I will be restarting an application when ever it goes down (App Availability HR get violated). This has been working successfully. 2. I have also written a script to purge the old logs when disk space utilization goes above certain threshold. This works fine as well. I am looking for some other use cases where this has been used or can be used. It would be really great if I can get suggestions and ideas on this. Thank You, Saad.

saad · ‎09-28-2021

@somesoni2 Tried this as well - still the same issue.

saad · ‎09-28-2021

@ashvinpandey what works? i think you missed something

saad · ‎09-28-2021

@ashvinpandey My monitoring Stanza. [monitor:////hboprod/itdept/jira/domain/logs/catalina.out] sourcetype = log4j ignoreOlderThan = 7d crcSalt = <string> [monitor:////hboprod/itdept/jira/domain/logs/access_log*.*] sourcetype = log4j ignoreOlderThan = 7d crcSalt = <string>

saad · ‎09-28-2021

@ashvinpandey My monitoring stanzas are as below - still it does not work - in fact after adding monitoring stanza for access_log even catalina.out has stopped getting monitored. when doing ./splunk list inputstatus I see below- /hboprod/itdept/jira/domain/logs/access_log.2021-09-26 parent = //hboprod/itdept/jira/domain/logs/catalina.out type = File did not match whitelist '^\/\/hboprod\/itdept\/jira\/domain\/logs/access_log[^/]*\.[^/]*$'. /hboprod/itdept/jira/domain/logs/access_log.2021-09-27 parent = //hboprod/itdept/jira/domain/logs/catalina.out type = File did not match whitelist '^\/\/hboprod\/itdept\/jira\/domain\/logs/access_log[^/]*\.[^/]*$'. /hboprod/itdept/jira/domain/logs/access_log.2021-09-28 parent = //hboprod/itdept/jira/domain/logs/catalina.out type = File did not match whitelist '^\/\/hboprod\/itdept\/jira\/domain\/logs/access_log[^/]*\.[^/]*$'.

saad · ‎09-28-2021

Hi @ashvinpandey , I have listed the file name in my orginal post, the file which i want to monitor is access_log and does not have any extension.

saad · ‎09-28-2021

Hello, I ahve below list of files in a directory and many more - below are few examples..... 210928105858:jira:HDL-APP004036:/hboprod/itdept/jira/domain/logs:$ ll total 147936 -rw-r--r-- 1 jira jira 376923 Sep 26 23:59 access_log.2021-09-26 -rw-r--r-- 1 jira jira 1547320 Sep 28 00:00 access_log.2021-09-27 -rw-r--r-- 1 jira jira 891543 Sep 28 10:56 access_log.2021-09-28 -rw-r--r-- 1 jira jira 881194 Sep 28 10:02 atlassian-jira-gc-2021-09-20_11-52-13.log.0.current -rw-r--r-- 1 jira jira 208279 Sep 28 10:49 atlassian-jira-gc-2021-09-28_10-04-10.log.0.current -rw-r----- 1 jira jira 8964 Sep 20 11:52 catalina.2021-09-20.log -rw-r--r-- 1 jira jira 8965 Sep 28 10:04 catalina.2021-09-28.log -rw-r--r-- 1 jira jira 768821 Sep 28 10:12 catalina.out -rw-r--r-- 1 jira jira 0 Sep 20 11:52 host-manager.2021-09-20.log -rw-r--r-- 1 jira jira 0 Sep 28 10:04 host-manager.2021-09-28.log -rw-r----- 1 jira jira 0 Sep 17 00:14 localhost.2021-09-17.log -rw-r--r-- 1 jira jira 0 Sep 20 11:52 localhost.2021-09-20.log -rw-r--r-- 1 jira jira 0 Sep 28 10:04 localhost.2021-09-28.log -rw-r--r-- 1 jira jira 0 Sep 20 11:52 manager.2021-09-20.log -rw-r--r-- 1 jira jira 0 Sep 28 10:04 manager.2021-09-28.log I want to monitor catalina.out and access_log files only and not others. I have configure monitoring stanza for catalina.out and it is working as expected for me. [monitor:////hboprod/itdept/jira/domain/logs/catalina.out] sourcetype = log4j ignoreOlderThan = 7d crcSalt = <string> I need help for writing monitoring stanza for access_log as this files gets created daily with that days date in it name. How can i configure this files to be monitored?

saad · ‎09-22-2021

Thank you for your response. But unfortunately this would not work as i dont have any file with access_log.log (my log file get created daily with that days date) I have a log file which gets created daily with todays date. for eg todays logfile name is "access_log.2021-09-22". A new file will be created tomm "access_log.2021-09-23". I want to monitor only todays file and not all the previous dates file in that directory.

saad · ‎09-22-2021

I guess you dint get my querry. I have a log file which get created daily with todays date. for eg todays logfile name is access_log.2021-09-22. A new file will be created tomm "access_log.2021-09-23". I want to monitor only todays file and not all the previous dates file in that directory.

saad · ‎09-22-2021

I want to monitor a log file which gets created everyday with new day date in its name. If I configure inputs.conf as below it will monitor all the older log files of previous days as well which will flood my source list, i want only the latest todays logfile to be monitored. Please suggest. [monitor:////path to direct/access_log.*] sourcetype = log4j ignoreOlderThan = 7d crcSalt = <string>

Posts	10
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎09-22-2021

Online Status	Offline
Date Last Visited	‎09-30-2021 07:32 PM

Triggering script on Health rule violation - Real ...

Regex and wildcard for inputs.conf file

Monitor stanza in inputs.conf file for rotating lo...

Triggering script on Health rule violation - Real ...

Re: Regex and wildcard for inputs.conf file

Re: Regex and wildcard for inputs.conf file

Re: Regex and wildcard for inputs.conf file

Re: Regex and wildcard for inputs.conf file

Re: Regex and wildcard for inputs.conf file

Regex and wildcard for inputs.conf file

Re: Monitor stanza in inputs.conf file for rotatin...

Re: Monitor stanza in inputs.conf file for rotatin...

Monitor stanza in inputs.conf file for rotating lo...

Are you a member of the Splunk Community?