[Gateway] Error Code description of SEVERE level

[leemi11]

I have one of customer who want to look at error code description include SEVERE level in gateway.

 

Background is that customer configured their alarm system to monitor just SEVERE word, but too many SEVERE makes false-positive. So they want to look at error code description of SEVERE level in gateway, so that they will be able to select parts of all SEVERE code.

 

They said they looked at below link, but there is no SEVERE level in documentation.
https://docops.ca.com/ca-api-gateway/9-1/en/reference/troubleshoot/audit-detail-codes

Does anyone have documentation regarding error code table include SEVERE level?

[Charles Lilienkamp]

As far as I understand the document supplied doesnt cover it because unless I am mistaken there are no Severe audit messages. Just severe from our logging, 

Gateway Log Event

 

Which isnt documented and can greatly vary depending on logger configuration package etc.. Instead of doing a global log watcher for Severe what are they trying to accomplish? What are they trying to monitor and possibly we can instruct them on the best way to do so.

 

Thanks, Charlie.

 

[leemi11]

Thanks for kindly response, Charles.

Customer does monitoring the critical event in log files in all of servers they have.

What they do is that in case of occuring Severe error in specific server, their maintanence team investigate server/service status and do troubleshoot the error. 

 

Seems like other solutions/products which they have have provided description of critical level error.

That's why they are asking if we have documentation of description including Severe error.

 

It would be much better if we have those kinds of documentation.

[Zhijun He]

If only monitor the key word "SEVERE", yes, they could get false alarm.

A log message is look like this,

2018-02-09T09:16:49.481+1100 SEVERE  4680 com.l7tech.server.SoapMessageProcessingServlet: Assertion not available: Code not available for assertion: CustomAssertion

 

If they can pickup the log level at 2nd column, they won't get false alarm.

 

So, it depends how they monitor...

[leemi11]

Thanks for the tip, Mark.

When I look at my test system, log message include key word "SEVERE" even though it is INFO level as below.

So If customer can pick up second column, it might reduce false alarm.

 

 18698 2018-01-18T17:23:54.877+0900 INFO    35 com.l7tech.server.audit.AuditAdminImpl: 1500: Full Details of Audit Search Criteria: {Start Time: Thu Jan 18 14:23:54 KST 2018} {Level: ALL to SEVERE} {Get from Audit Lookup Policy: false}

[Zhijun He]

Yes, if your customer can pick up 2nd column, it's not "might", there will be no false alarm.