logmon regexp Help

[kanandaguberan]

Hi,

 

I am monitoring the oracle alert log and we need to alert for all ORA instances. However there were instances where logmon was not able to capture all the alerts at times. We have had an instance where there were three consecutive ora instances however just one was reported. The regular expression that we use is this

 

/(ORA-\d+)(.*)/

 

Is the issue of not able to pick some ora instances is due to the regexp? Please clarify.

 

 

-kag

[Charles Lilienkamp]

Hi,

I dont know if this questions is particular to nimsoft or sysedge. I suspect nimsoft.

the REgex you supply should work for anything

ORA-x(something) (where the log has ORA (uppercase no lowercase match) - (dash) and followed by a number).

 

This assumes of course that the Regular Expression Engine evaluating is using a PCRE engine.

any ORA-NonNumeric will not be matched.

 

If this is sysedge please do let me know. Or feel free to open a CA case if needed on whichever product you are using if there is no reply.

Thanks.

[rrustong.1]

Check to make sure you don't have the "Abort on Match" option checked under Watcher Rules > Advanced as this will cause only the first instance to be matched.

[kanandaguberan]

Hi,

 

The 'Abort on Match' option is disabled upon checking.

 

-kag

[kanandaguberan]

Hi Charles,

 

This is with reference to Nimsoft. And yes, the regexp seems to be correct, however we have seen some instances where we did not get the ora messages. And in this case, the ora messages seems to have come in a single line with 2 matches. Will this work if this is the case?

 

 

-kag

[Anon Anon]

And you haven't specified custom formatting either? Or max alerts on the profile tab?

 

-jon

[kanandaguberan]

Hi Jon,

 

Thanks for the update. I just verified that there was a nas pre-processor running to ignore this alert.My bad

 

-kag

[Anon Anon]

Heh yeah, I used to have similar issues with exclude type preprocessor rules. That's why I shiften to using PP / AO scripts that either made the alarms invisible instead, or downgraded them all to "informational" severity. Those I could easily clean up and they would still leave a trace. Easier to troubleshoot, and if someone excluded a bit too much by accident, I still would know what went down. We're using those rules a lot as more fine grained "maintenance windows".

 

-jon