Enterprise SIEM, Centralized Log Management, Security, Compliance, Server Monitoring and Uptime Monitoring Software
Table of Contents

Log Monitor Template

The Log Monitor Template enables you to fire actions when specific entries are detected. Some of the Log Consolidation Templates, such as Event Log Consolidation and Text Log Consolidation, include post consolidation monitors enabling you to scan consolidated log entries as they are received rather than creating multiple templates, one for consolidation and one for monitoring. Since Syslog monitoring is real-time, Syslogs are the the exception to this rule. Log Monitoring is configured via the Rules Tab found within each supported template's properites view.

To create a new Log Monitor Template

  • From the menu bar, select File | New | Template then expand Template | Log Management and finally select Log Monitor. The New Template View displays.
  • Use the Sub type drop-down to select the log type.
  • Use the Rules Tab to assign multiple log monitor rules.
  • To add a new rule, click the Add button. The Log Monitor Rule Dialog displays.
  • From the Log Monitor Rule Dialog, use the Filter Drop-Down to assign the log entry filter to apply.
  • You can apply one of three different rules to the filter:
    Fire the action once for every entry that passes this filterDepending on the type of monitor, the assigned actions are fired once for each entry received in real-time or once for each batch of entries.
    Fire the action after an entry passes this filterAssigned actions are fired after the configured threshold has triggered. The less than operand is executed 30 seconds after the top of the minute.
    Fire the action after an entry passes this filter and then entries pass the following filter Assigned actions are fired after the first filter is triggered then after the second filter is triggered. This option enables you to get notified when the time span between two entries is too great or non-existent. For example, get notified when a text log contians a started message but does not contain a completed message within the configured time span.
  • Use the Set monitor state to drop-down to configure the state to set the monitor to once triggered. If you do not want to trigger the state, set the state to OK.
  • Use the On Trigger Drop-Down to assign the actions to fire once the monitor triggers.
  • Use the Limit to check box to limit the number of times the actions are fired within the configured time span.
Event Log Monitor Trigger Properties

Related Topics

General Tab

Columns Tab

Actions Tab

Log Management Templates