Editing a Real-Time File Log Source

You can modify the following fields of the Real-Time File log source:

Option

Description

General

Log Source Enabled

Click toggle button Yes or No to define whether the current Log Source is enabled or disabled.

Name

Name of the Log Source.

Description

Description of the Log Source.

Forwarders

Select Forwarder

Select the Forwarding connection to which you want to forward collected RT File logs from dropdown list.

Universal Collector Collection date

Define whether the log message sent to the LogLogic LMI server remains in a local system time zone or is converted into UTC time zone.

Message Filter

Message Filter

Click Yes or No to activate or deactivate the option.

Collect messages

Define whether you collect messages that:

Collect logs matching regex pattern
Not matching Regex (that is, filter the logs that match the regex)

Filter

Enter a case insensitive regular expression to specify the messages to be matched.

For example, if “Not matching regex is selected”:

"packet accepted" means that all the lines containing packet accepted are filtered.

"^64\.242" means that all the lines that are beginning exactly with 64.242 are filtered.

"846$" means that all the lines that are ending exactly with 846 are filtered.

For example, if “Matching regex is selected”:

"packet accepted" means that only the lines containing packet accepted are kept.

"^64\.242" means that only the lines that are beginning exactly with 64.242 are kept.

"846$" means that only the lines that are ending exactly with 846 are kept.

Collection

File Path

Specify the path of the log file to be collected.

NOTE: Log file must be present at host machine where Hawk Agent is running.

If the log file is rotated, you may enter [id] or [date] or both in the file name and configure the File rotation parameters.

For example, c:\temp\logFile[date].log to obtain file names such as logFile20170521.log

File rotation

Click Yes or No to activate or deactivate the option.

(If File rotation is active) Date pattern

Select the check box and enter the date format you want to use for the [date] parameter.

For example, yyyyMMdd for 20170421.

(If File rotation is active) Max number of digits

Select the check box and enter the maximum number of digits you want for the [id] parameter.

Universal Collector microagent can collect any file with an [id] whose number of digits is between 1 and 9 inclusive.

For example, If you set 5, the following [id] will be taken into account: 1, 054, 586, 00599, 78945, etc.

File change notification

Click Yes or No to activate or deactivate the option. This option allows you to monitor file changes. If set Yes, a notification will be sent to LogLogic LMI through the uc.log file when the modified date of the specified file changes. The notification includes the changed content and time. A new log is recorded for the notification when Universal Collector microagent internal logs are forwarded to LogLogic LMI. The file changes are not monitored for rotated files. In this case, the File change notification option is disabled.

The specified file size must be less than the default size (10MB). If the file size is more than 10MB, the notification does not include changed content.

Before activating this monitoring option, ensure that you set the LMI Connection > Forwarding > Forward UC Internal Logs option is ON.

Multiline messages

Click Yes or No to activate or deactivate the option to define whether the single message has several lines.

(If Multiline messages is ON) Multiline Header Type

Select the type of multi-line logs.

For example, 'jboss', 'tomcat', 'weblogic', 'websphere' or 'custom'.

(If Multiline messages is ON) Custom Header regex

Set a regular expression matching the header of the first line of a log.

(If Multiline messages is ON) Custom Separator

Specify a custom delimiter to use as a separator for multiple lines. The default separator is \r\n. If the field is empty, a space is added in the message.

(If Multiline messages is ON) Send orphaned lines

Indicate whether you want Universal Collector microagent to send messages that do not match the Header Regex.

(If Multiline messages is ON) Multiline timeout after detected header

Indicate the number of seconds after which the multi-line logs are ready to be sent.

 

Advanced

Host name

Enter the name of the host used to pair logs on the LogLogic LMI server.

For example, customHostname.com

If you enter an IPv4 address, the device to be displayed in LogLogic LMI will be referred with this IP address.

Application name

Enter the name of the application used to identify logs on the LogLogic LMI server.

For example, customApplicationName

Maximum message length

Indicate the possible maximum length for the message (in bytes). The maximum supported value is 1048576.

Default value: 64000

To specify a message length of more than 64000 bytes, ensure that you use LogLogic LMI 6.2.0 and later versions.

Charset

Select the data format.

Default value: Use local system charset