• Forums
    • Public Forums
      • Community Connect
      • Dynatrace
        • Dynatrace Open Q&A
      • Application Monitoring & UEM
        • AppMon & UEM Open Q&A
      • Network Application Monitoring
        • NAM Open Q&A
  • Home /
  • Public Forums /
  • Application Monitoring & UEM /
  • AppMon & UEM Open Q&A /
avatar image
Question by gil g. · Sep 11, 2012 at 04:38 PM ·

close incident based on log record

Hi,

I have been requested to have an incident be created when an application log receives a certain message (for example "no ink in printer") and close this incident only when a new log line such as "ink replaced" has been seen in the log.

1. Is this possible with DynaTrace (custom monitor can be created) ?
2. Will I be able to later on create a report to display the monthly uptime of this machine, based on the duration of such incidents ?

Thanks,

Gil.

Comment

People who like this

0 Show 0
10 |2000000 characters needed characters left characters exceeded
  • Viewable by all users
  • Viewable by moderators
  • Viewable by moderators and the original poster
  • Advanced visibility
Toggle Comment visibility. Current Visibility: Viewable by all users

Up to 10 attachments (including images) can be used with a maximum of 50.0 MiB each and 250.0 MiB total.

1 Reply

  • Sort: 
  • Most voted
  • Newest
  • Oldest
avatar image

Answer by Andreas G. · Sep 11, 2012 at 04:50 PM

I think a custom monitor would work well in this use case. The monitor would basically return a single "status" measure with the value 0=ink present, 1=no ink.
You can then define an incident that triggers if this measure is >= 1.

You can then either report on the Incident Duration or also just on the Status Measure itself.

Comment

People who like this

0 Show 6 · Share
10 |2000000 characters needed characters left characters exceeded
  • Viewable by all users
  • Viewable by moderators
  • Viewable by moderators and the original poster
  • Advanced visibility
Toggle Comment visibility. Current Visibility: Viewable by all users

Up to 10 attachments (including images) can be used with a maximum of 50.0 MiB each and 250.0 MiB total.

avatar image gil g. · Sep 11, 2012 at 04:56 PM 0
Share

Thanks Andreas (smile)
in that case, when will the incident be closed ? once it seems the monitor has changed to 0 ?

Additionally, as for the report - what if I have several incidents that I will need all of them to be calculated as a sum ? would you suggest a global incident saying "SYSTEM DOWN" with several conditions being OR'ed ?

avatar image Andreas G. ♦ gil g. · Sep 11, 2012 at 05:04 PM 0
Share

The Incident will be closed once the measure goes back to 0. Here please be aware of the Settings in the Incident Rule Dialog. In your case you want an evaluation period that matches the execution interval of your monitor, e.g: every minute

As to your report question. You have two options here:
a) You can create a SYSTEM DOWN Incident that ORs your measures
b) You can put an Incident Chart on a dashlet. An Incident Chart allows displaying multiple Incident Rules. If you uncheck the "Split Chart" option the chart will show you an "aggregate" of all Incident Rules. That means - once one of the Incident Rules goes RED the whole chart goes RED.

The drawback of the second option is that it is "just visual" and it wont allow you to trigger an action, e.g: sending an email

hope this helps

avatar image gil g. Andreas G. ♦ · Sep 13, 2012 at 04:44 PM 0
Share

Andreas,

Since the "no ink" would appear only once in the log, How would I save its state or avoid resetting the monitor to 0 ?

Gil.

avatar image Andreas G. ♦ gil g. · Sep 13, 2012 at 06:51 PM 0
Share

You can keep the state in your monitor implementation. Once you see the log message you report 0 and keep reporting 0 unless you see a different log message. Have a look at Manage and Develop User Plugins - it explains the lifecycle of a monitor plugin.

Andi

avatar image gil g. Andreas G. ♦ · Sep 23, 2012 at 08:16 PM 0
Share

Still strugling ...

perhaps I'm missing something. since the monitor is runnign every x, I need to be able to only track changes (for example lines added to log file) during the interval. Performance wise it would be wrong to read all data from scratch each run. How would you suggest doing that ? are you familiar of any sample code/user plugin that is working similarily ?

Gil.

avatar image Andreas G. ♦ gil g. · Sep 24, 2012 at 05:12 PM 0
Share

You should be able to keep some state information in your plugin, e.g: the last timestamp of the log message you processed. When you then read the file again you start from that position where you last stopped.

I do not have an example for this at hand

How to get started

First steps in the forum
Read Community User Guide
Best practices of using forum

NAM 2019 SP5 is available


Check the RHEL support added in the latest NAM service pack.

Learn more

LIVE WEBINAR

"Performance Clinic - Monitoring as a Self Service with Dynatrace"


JANUARY 15, 3:00 PM GMT / 10:00 AM ET

Register here

Follow this Question

Answers Answers and Comments

1 Person is following this question.

avatar image

Forum Tags

dotnet mobile monitoring load iis 6.5 kubernetes mainframe rest api dashboard framework 7.0 appmon 7 health monitoring adk log monitoring services auto-detection uem webserver test automation license web performance monitoring ios nam probe collector migration mq web services knowledge sharing reports window java hybris javascript appmon sensors good to know extensions search 6.3+ server documentation easytravel web dashboard kibana system profile purelytics docker splunk 6.1 process groups account 7.2 rest dynatrace saas spa guardian appmon administration production user actions postgresql upgrade oneagent measures security Dynatrace Managed transactionflow technologies diagnostics user session monitoring unique users continuous delivery sharing configuration alerting NGINX splitting business transaction client 6.3 installation database scheduler apache mobileapp RUM php dashlet azure purepath agent 7.1 appmonsaas messagebroker nodejs 6.2 android sensor performance warehouse
  • Forums
  • Public Forums
    • Community Connect
    • Dynatrace
      • Dynatrace Open Q&A
    • Application Monitoring & UEM
      • AppMon & UEM Open Q&A
    • Network Application Monitoring
      • NAM Open Q&A