This topic provides information about the supported resource tpyes and message types, as well as configuration options.

Hyperic supports log tracking for operating system platforms, network services, and most server types. If a resource supports log tracking, its Configuration Properties page contains log tracking configuration options.

Hyperic can monitor and record events for:

Log file messages that specify log levels using log4j log levels.

Events written to Windows Event Logs.

Network request results for a variety of network services.

You enable and configure log tracking for a resource on its Configuration Properties page. Navigate to the resource's Inventory page, and click Edit in the Configuration Properties section to display the Configuration Properties page.

Note

Log and configuration tracking must be enabled for a resource if you wish to log events for log messages or configuration changes. Event logging is automatic for alerts and control actions. Log tracking configuration options vary somewhat by resource type.

This section describes the log tracking configuration options for resources that whose log files use logj4 levels.

An authorized user can set the values of these configuration options:

Enable/disable log tracking.

Specify one or more files to track, as a comma-separated list. The Hyperic Agent must be able to read these files, so make sure permissions are set appropriately.

Specify the highest log level to track:

Error - Messages with log level FATAL or ERROR

Warn

Info

Debug

Specify substrings or expressions to use as include/exclude filter criteria. Enter a substring or a regular expression that a log message must contain or match in Log Pattern Match.

This section describes the log tracking configuration options for network services.

An authorized user can set the values of these configuration options:

Enable/disable log tracking.

Specify the highest log level to track:

Error

Warn

Info

Debug

Specify substrings or expressions to use as include/exclude filter criteria. Enter a substring or a regular expression that a log message must contain or match in Log Pattern Match.

This section describes the log tracking configuration options for platforms of type "win32".

An authorized user can set the values of these configuration options:

Enable/disable log tracking.

Specify one or more Event Log to track:

System - contains events logged by Windows system components. For example, if a driver fails to load during startup, an event is recorded in the system log. Windows predetermines the events that are logged by system components.

Application - contains events logged by programs. For example, a database program may record a file error in the application log. Events that are written to the application log are determined by the developers of the software program.

Security - contains events such as valid and invalid logon attempts, as well as events related to resource use, such as the creating, opening, or deleting of files. For example, when logon auditing is enabled, an event is recorded in the security log each time a user attempts to log on to the computer. A Windows administrator or member of the Windows Administrators group specify which events are recorded in the security log.

* - causes all event logs to be tracked.

Specify the highest log level to track:

Error

Warn

Info

Debug

When Windows log tracking is enabled, an entry of this form is logged for events that match the criteria you specified on the resource's Configuration Properties page:

[Timestamp] Log Message (EventLogName):
EventLogName:EventAttributes

where:

Timestamp - is when the event occurred

Log Message - is an text string

EventLogName - is the Windows event log type, "System", "Security", or "Application".

EventAttributes - a colon delimited string made of the Windows event Source and Message attributes.

For example, this log entry:

04/19/2010 06:06 AM Log Message (SYSTEM): SYSTEM: Print: 
Printer HP LaserJet 6P was paused

is for an Windows event written to the Windows System event log at 6:06 AM on 04/19/2010. The Windows event Source and Message attributes, are "Print" and "Printer HP LaserJet 6P was paused.", respectively.

You can configure the last portion of the log data that the agent writes for a Windows event - referred to above as EventAttributes. You can include additional event attributes, for example User and Computer. To do so, you add the platform.log_track.eventfmt property to the agent.properties file for the vCenter Hyperic agent monitoring the Windows platform.

This property specifies the content and format of the Windows event attributes that a vCenter Hyperic agent includes when logging a Windows event as an event in vCenter Hyperic.

agent.properties does not contain the platform.log_track.eventfmt property, you must explicitly add it if you want to tailor the data logged for Windows events.

When Windows log tracking is enabled, an entry of this form is logged for events that match the criteria you specified on the resource's Configuration Properties page.

You can use the parameters below to configure the Windows event attributes that the agent writes for a Windows event. Each parameter maps to Windows event attribute of the same name.

%user% - The name of the user on whose behalf the event occurred.

%computer% - The name of the computer on which the event occurred.

%source% - The software that logged the Windows event.

%event% - A number identifying the particular event type.

%message% - The event message.

%category% - An application-specific value used for grouping events.