Creating a Log File Monitor Rule Group
This option is used to add a new Log File Monitor rule group. Note that on the first use, no rule groups exist.
- From the Halcyon main menu select option 5=Work with Rules.
- Scroll down to find the Log File Monitor. Type 1 next to the Log File Monitor and press Enter to open the Add Log File Rule Group display.
Fields on the Add Log File Rule Group display
The following fields are available when adding a Log File Monitor rule group. These fields define the common monitoring functionality of the rule group.
Log File group
Enter the name by which this Log File rule group is identified.
Description
Enter a description for the Log File rule group. The entry made here is displayed on the Work with Rules main display.
Enter the interval in seconds between each check of the rules defined within the Log File rule group. The lower the value, the more frequent the check is made. The value entered must be within the range 60-86400. For reference: 3600 seconds = 1 hour, 43200 seconds = 12 hours, 86400 seconds = 24 hours.
Start time
Enter the time at which monitoring starts for the Log File rule group.
| *ALL | Always monitor this rule group |
| HH:MM | Start monitoring at the specified time (use 24 hour clock settings) |
End time
Enter the time at which monitoring ends for this rule group.
| *ALL | Always monitor this rule group |
| HH:MM | End monitoring at the specified time (uses the 24 hour clock settings |
Enter the integrated file system (IFS) path of the log file(s) to monitor. With File type *XML, a URL may be specified instead of a path.
To specify a file in the QSYS.LIB file system, you can type one of:
- Library/File
- Library/File.Member
or use F4=Prompt.
The value typed automatically expands to the equivalent IFS notation. To specify an IFS path, begin the path with a forward slash ( / ).
The last component of a path may be *generic* in both the file name and/or the extended part of the component.
- starts_like*
- ends_like*
- *contains*
Additionally, with QSYS.LIB files, the file name may also be a simple generic (ends_like*) in addition to the full generic in the member name.
Paths may or may not be case sensitive depending on the attributes of the file system they are in. A generic path component is not case sensitive regardless of the file system.
Field definition population
- If you type a valid path and the path exists, field definitions may be populated automatically.
- With externally described QSYS.LIB files, the field definitions are retrieved from the file.
- With other files, the field definitions are calculated by parsing the file data. In this case, you should verify that the field definitions are correct and make any corrections that may be necessary. If the file does not exist or contains no data, you must define the fields manually.
F4 is available on the path field.
User name
This field is only visible when a *URL is specified as the Path.
Specifies the user name to be used to log on to the server. If a user name is specified, a password must also be provided.
| *NONE | This server does not require a log on |
| &Varname | Specify the name of a substitution variable that contains the user name to be used to log on to the server. The substitution variable value can be up to 128 characters |
| name | Type a specific user name |
Password
This field is only visible when a *URL is specified as the Path.
Specifies the password to be used to log on to the server.
| &Varname | Specify the name of a substitution variable that contains the password to be used to log on to the server. The substitution variable value can be up to 128 characters |
| name | Type a specific password |
The following file types are supported for monitoring purposes in Log File Monitor.
| *CERT | Indicates a certificate store. The digital certificates in the store are retrieved as XML records. You can then define fields to extract the required attributes of the certificates. This file type uses different criteria than the other file types in Log File Monitor. See Digital Certificate Monitoring for more information. |
|
Indicates a file with variable lengths fields delimited by commas. Field values may optionally be enclosed in double quotes ("). If this is the case, the double quotes do not form part of the field value. Double quotes are required if the field value includes a comma. |
|
|
Indicates a file with fixed field starting positions and lengths. |
|
| *HYBRID |
Indicates a file comprising a variable length section at the start of each record followed by a fixed length section. The variable length section is identified by opening and closing characters, typically square brackets, and contains one or more variable length fields, typically delimited by blanks. *HYBRID files that contain a variable length section that does not adhere to the definitions specified in the Additional Options are ignored. The fixed length section contains one or more fixed length fields, with start positions fixed relative to the start of the variable length section. Log File Monitor handles hybrid files by converting each record to fixed length format when read. Press F20=Additional Options to specify how the variable length area is identified and to assign fixed lengths to each variable length field. Then define each field by its start position and length in the converted data. NOTE: A *HYBRID file is only auto-detected if the opening and closing delimiters match those defined in the F20=Additional Options window. If a *HYBRID file uses different delimiters, set the delimiters first using F20=Additional Options then use F17=Auto-define.
|
| *MULTIR | Indicates a file where log entries may consist of multiple consecutive records. A blank record separates each log entry. Log File Monitor handles multiple record log entry files by concatenating the records in each log entry into a single logical record. Each field can then be defined by its start position and length in the concatenated data. |
| *XML |
Indicates XML-only data, either in a file or on an HTTP server. With this file type, Log File Monitor processes logical XML records, not file records. Logical XML records may span multiple file records. Each logical XML record begins with the primary tag specified and ends at the matching closing tag. The maximum size of logical XML records that can be processed is 32766 characters. If logical XML records exceed 32766 characters, use XML Filters to reduce the size of the record. To define the primary tag and to set XML filters, press F20=Additional options. NOTE: The *XML option can also read HTML data.
|
| *UNDEF | Indicates that the file type has not been defined. You cannot save the rule group with this setting. Type *CSV, *FIXED, *HYBRID or *XML, or press F17=Auto-define to detect the file type automatically. |
Record length
This field is used mainly for remote access. When monitoring a QSYS.LIB file on a remote system, via the QFileSvr.400 file system, the Record length must be specified, because the monitor cannot determine the record length when it reads the data. Use F17=Auto-Define to automatically set the field.
Specify the record length of the file.
| *VARY | The length of each record may vary. Each record is terminated by the characters CR, LF, CRLF or LFCR |
| 1-32766 | All records have the specified length. If CR or LF characters are found in the data, they have no special significance |
Check file exists
This specifies whether the log files to be monitored should always exist. The default setting is *YES. Log File Monitor verifies the entered path and issues an error message if a problem is found. Use *NO if you are setting up a rule group for a file that does not currently exist.
|
*YES |
When the rule group is processed, the following messages are logged if the file specified cannot be read for any reason.
In the case of a generic path, the directory must exist but messages are not logged if no generic matches are found. |
| *NO | When the rule group is processed the messages are not logged but authority and other messages are still recorded. |
Header row
Specifies whether the first record in the file is a header row. Header rows contain field names rather than data and are ignored when a file is processed.
Header rows are supported for file types *CSV and *FIXED, but exclude QSYS.LIB externally described files.
| *YES | This file has a header row. The first record contains field names rather than values. |
| *NO | The file does not have a header row. |
| *UNDEF | Indicates that header row has not been defined. You cannot save the rule group with this setting. Type *YES or *NO, or press F17=Auto-define to detect whether there is a header row automatically. |
Error tolerance
Error tolerance defines whether or not a run-time error causes the rule group to stop monitoring a file or URL.
A run-time error occurs when data in a field is not valid for the specified field type and is not handled by an %IF %ERROR function.
A run-time error is also caused by a function error, for example, if a function attempts to divide by zero.
|
*NOMAX |
All run-time errors are tolerated. The record containing the erroneous value is ignored and monitoring continues. |
| *NONE | No run-time errors are tolerated. If a record containing invalid data is read, the rule group stops monitoring the file. |
| 1-99% | Some run-time errors are tolerated. If the percentage of records containing invalid data reaches the value specified, and more than 10 records have been read, the rule group stops monitoring the file. |
When a generic path is specified, this value applies individually to each file or member read by the rule group, so the rule group only stops monitoring the file with the error and continues to monitor other files that meet the generic path criteria.
To restart monitoring on all files being processed by this rule group, if for example you have added error handling routines, you must hold and release the rule group using the Hold Rule (HLDRULE) and Release Rule (RLSRULE) commands or by using options 7=Hold and 6=Release on the Work with Rules display.
Error logging level
This setting controls the logging of run-time error and warning messages.
A run-time error occurs when:
- The data for a field is not valid for the field type defined in the rule group and the value is not corrected by attaching an %IF %ERROR function.
- A function attached to a field fails, for example by attempting to divide by zero.
A run-time warning occurs when:
- The data for a field is not valid for the field type defined in the rule group but the value is corrected by attaching an %IF %ERROR function.
|
HIGH |
Both run-time error and warnings are logged |
| NORMAL | Run-time error message are logged. Run-time warning messages are not logged. |
| LOW | Neither run-time error nor warning messages are logged. |
This specifies which records to monitor, either all records or only new records found since the last check was made. For a genuine log file use the *NEW setting. For a Status file, use *ALL.
|
*NEW |
Records already in the file when the Log File Monitor is started are not read. The Log File Monitor reads any records subsequently added and raises an alert for each record found that matches the selection criteria. This is the usual setting for log files. This setting does not apply to *XML file types as they always check all data. |
| *ALL | The Log File Monitor reads all records at each interval and raises an alert for each record found that matches the selection criteria. The same record may cause multiple alerts unless prevented by suspend settings. Use this setting to monitor files that show a status indicator. |
If is set to *NEW, up to three key fields may be specified the records Log File Monitor can use to track progress through the log files and determine which records are new. The fields specified should, when taken together, increase in value as records are added to the file. Typically, Date and Time fields, indicating when the record was added, would be used as the first two key fields. If there is a milliseconds or sequence number field for the record use this as the third key field.
The first key field must be:
- a date field
- a numeric field that returns a date in YYYYMMDD format
- a *CALC field or character field with attached function that returns a date in YYYYMMDD format.
The optional second key field must be:
- a time field
- a numeric field that returns a time in HHMMSS format
- a *CALC field or character field with attached function that returns a time in HHMMSS format.
The optional third key must be a numeric field.
If there are no suitable key fields, use the special value *RRN (Relative Record Number). This specifies processing by RRN only.
|
Use relative record number for progress tracking. This value cannot be used with QSYS.LIB files that allow deleted records to be reused NOTE: With QSYS.LIB files, it is not necessary for the fields specified to be actual key fields in the file.
|
Press Page Down to view the File Field Layout into which the log file fields can be defined.