Call file in logmon probe with regular expression

[Miller Echagarreta]

Hi all.
I need to call a file that change daily each hour with logmon probe for monitoring.

This is the structure file: \app\logs\obserview_20191213_1.txt
And this file change in an hour to obserview_20191213_2.txt then obserview_20191213_3.txt  ....

I am trying to use this regular expression  but not work

\app\logs\obserview_%Y%m%d_[1-9].txt
\app\logs\obserview_%Y%m%d_[123456789].txt

This file maybe it grows of 1 to 20 for example \obserview_20191213_18.txt

How can I to create this regular expression that work?

[Garin Walsh]

Logmon will happily watch all files that match the pattern so \app\logs\obserview_*.txt will achieve what you want. It doesn't use true regular expressions so you have to be careful.

Only issue with that approach is that if there are very many files (hundreds or more) or you check very often (like every 30 seconds) then it can take a noticeable amount of CPU to process through the list of files.

Otherwise make sure you are using the correct patters - it is different between Windows and Linux.

Also set your log level to 5 and look to see what it is actually matching.

[Miller Echagarreta]

Hi @Garin Walsh I tried your sugerence ​but not work. These are the test that i maked.

This is the call of a file ------>

[Miller Echagarreta]

@Garin Walsh look these lines from logmon probe in loglevel 5. 

Dec 16 12:00:27:568 [21220] logmon: expandStrftime: locale found[English_United States.1252]

Dec 16 12:00:27:568 [21220] logmon: (expandStrftime)leaving critical section

Dec 16 12:00:27:568 [21220] logmon: pchPath E:\SRT\Logs\Postilion\Postilion_20191216_[0-9].txt, pchFileName: Postilion_20191216_[0-9].txt

Dec 16 12:00:27:568 [21220] logmon: fileInit - <no user>

Dec 16 12:00:27:568 [21220] logmon: setting privileges needed

Dec 16 12:00:27:568 [21220] logmon: fileSetId - 

Dec 16 12:00:27:568 [21220] logmon: fileFind - getting file lock

Dec 16 12:00:27:568 [21220] logmon: fileFind - got file lock

Dec 16 12:00:27:568 [21220] logmon: tail_file - E:\SRT\Logs\Postilion\Postilion_20191216_[0-9].txt (50000)

Dec 16 12:00:27:568 [21220] logmon: cmd_tail_file: tail_file - unable to open E:\SRT\Logs\Postilion\Postilion_20191216_[0-9].txt

Dec 16 12:00:27:568 [21220] logmon: scan - getting csMappingLock lock

Dec 16 12:00:27:568 [21220] logmon: scan - leaving csMappingLock lock

Dec 16 12:00:27:568 [21220] logmon: fileCleanup - <no user>

Dec 16 12:00:27:568 [21220] logmon: SREPLY: status = 1(error) ->172.16.1.60/55520

Dec 16 12:00:27:568 [21220] logmon:  head   mtype=200 status=1 seq=0

Dec 16 12:00:27:568 [21220] logmon: RREQUEST: _close <-172.16.1.60/55520  h=295 d=0

Dec 16 12:00:27:568 [21220] logmon: sockClose:00000037EF4B12B0:172.19.202.77/48012

Dec 16 12:00:28:693 [6780] logmon: getFromDB: refEOF 2098646

Dec 16 12:00:28:693 [6780] logmon: getFromDB: refchar_first 32

[Garin Walsh]

If you use patterns in the name of the file, you can not use the "view" button. The view button passes the text specified as the actual filename and so will not work with filenames with patterns.

Set the log level to 5 and look at the output there - it will list the file names matched - maybe.

[Miller Echagarreta]

@Garin Walsh thank you so much ​ for your help, you right with patterns in the name of the file i can not use the "view" button. I look on the logs probe and the monitoring it's working. Today i have learned something new.
I use this expression "\logs\obserview_*.txt"
Thank again