ITM Agent Insights: Monitoring logs with ITM: Log Monitoring Options
DougDoering 120000E6GG Comment (1) Visits (11382)
Monitoring the contents of log files is a common requirement for many environments, and IBM Tivoli Monitoring provides numerous solutions to assist customers with fulfilling this need. This post will provide a quick summary of available options for monitoring logs for different environments.
Tivoli Monitoring provides many monitoring agents, and many application agents will gather data specific to logs for that application.
Below are the "general" log monitoring solutions not specific to a particular application.
The "UNIX Logs" monitoring agent - UL - compid 5724C04LA.
The UL component can monitor basic text logs, and "system" type logs on UNIX / Linux environments.
It is limited to a single format statement per monitored log, limiting the ability to parse different messages into their own unique attributes.
The UL agent is an older agent that is deprecated, meaning it is not being shipped in current releases as it has been replaced going forward by the Log File Agent - LO.
The "Universal Agent" - UM - compid 5724K1000.
The UM is a generic custom application product where you can define attribute collection definitions for various data collectors in a metafile (.mdl) which can be used to gather data from scripts, or files, etc. Monitoring of "logs" can be done with the FILE data provider (for more traditional application logs), or the SCRIPT data provider (for monitoring the output of a custom script).
The custom applications created with the Universal Agent can be tailored to specific monitoring needs, but the creation of the custom application definitions requires familiarity with the UA framework. It is not a trivial task to create custom applications with the Universal Agent.
The Universal Agent is an older solution that is also deprecated, and not shipped in current ITM releases.
For general custom agent creation, the Universal Agent has been replaced going forward with the Agent Builder. For log monitoring, the Universal Agent is replaced by the Log File Agent - LO.
As stated, the UL and UM components are deprecated, and no longer shipped in ITM images starting with the 6.3 release:
Tivoli Monitoring > Tivoli Monitoring 6.3.0 > Version 6.3 > New in this release
To support legacy environments, the latest UL / UM agents can be installed from 6.23 images, the latest maintenance package that includes UM and UL agent components:
The "UNIX OS" monitoring agent - UX - compid 5724C040U, and "Linux OS" monitoring agent - LZ - compid 5724C04LN.
The UX / LZ agents can perform rudimentary monitor of the contents of a log file by use of "grep" command with "File Pattern" attribute group.
The "Windows OS" monitoring agent - NT - compid 5724C040W.
The NT agent can monitor Windows OS Event logs with the "Event Log" attribute group (NTEVTLOG).
Starting with 220.127.116.11 level, the OS agents (UX, LZ, NT) added function to allow customers to gather outputs using custom scripts.
DCF 1960062 - OS Agents Version 6.3.0 FixPack 5 Scripting Feature
The custom scripting feature can be used to perform "log" monitoring by defining a user script to read a file and output the contents, which can then be processed by the custom scripting feature based on definitions in the .properties file.
The "Agent Builder" - compid 5724c04br (ITM 6.3.3) / 5725u05ab (APM 8.1.3).
The Agent Builder is a generic custom agent tool based on Eclipse technology.
The Agent Builder allows data to be monitored from the following data sources:
The Agent Builder can also use the output of a custom script as the data source.
The custom monitoring agents created with the Agent Builder can be tailored to specific monitoring needs, but the creation of the custom agent requires familiarity with the Agent Builder and maintaining version control for agent definitions and their application support. It is not a trivial task to create custom monitoring agents with Agent Builder.
The "Log File Agent" or LFA - LO - compid 5724C04LF.
The LO agent is a generic log monitoring solution which can be customized to meet most log monitoring needs.
It can be configured to monitor system logs on UNIX, event logs on Windows, application logs, and is supported on UNIX / Linux / Windows environments.
The use of regular expressions for matching log entries allows for flexibility in which entries to monitor in a log, and the creation of situation alerts relying on specific error conditions.
The LO agent is the preferred method of monitoring logs over any of the other customizable solutions as it has a lot of built-in functionality.
Why spend time re-inventing the wheel with Universal Agent or Agent Builder when you can utilize the embedded function of the LO agent?
The LO agent is the strategic direction going forward, and is utilized by log monitoring solutions such as SCALA:
SmartCloud Analytics Log Analysis (SCALA) - compid 5725K2600.
Additional ITM Agent Insights series of IBM Tivoli Monitoring Agent blogs are indexed under ITM
Subscribe and follow us for all the latest information directly on your social feeds: