close incident based on log record
Hi,
I have been requested to have an incident be created when an application log receives a certain message (for example "no ink in printer") and close this incident only when a new log line such as "ink replaced" has been seen in the log.
1. Is this possible with DynaTrace (custom monitor can be created) ?
2. Will I be able to later on create a report to display the monthly uptime of this machine, based on the duration of such incidents ?
Thanks,
Gil.
I think a custom monitor would work well in this use case. The monitor would basically return a single "status" measure with the value 0=ink present, 1=no ink.
You can then define an incident that triggers if this measure is >= 1.
You can then either report on the Incident Duration or also just on the Status Measure itself.
Thanks Andreas 
in that case, when will the incident be closed ? once it seems the monitor has changed to 0 ?
Additionally, as for the report - what if I have several incidents that I will need all of them to be calculated as a sum ? would you suggest a global incident saying "SYSTEM DOWN" with several conditions being OR'ed ?
The Incident will be closed once the measure goes back to 0. Here please be aware of the Settings in the Incident Rule Dialog. In your case you want an evaluation period that matches the execution interval of your monitor, e.g: every minute
As to your report question. You have two options here:
a) You can create a SYSTEM DOWN Incident that ORs your measures
b) You can put an Incident Chart on a dashlet. An Incident Chart allows displaying multiple Incident Rules. If you uncheck the "Split Chart" option the chart will show you an "aggregate" of all Incident Rules. That means - once one of the Incident Rules goes RED the whole chart goes RED.
The drawback of the second option is that it is "just visual" and it wont allow you to trigger an action, e.g: sending an email
hope this helps
Andreas,
Since the "no ink" would appear only once in the log, How would I save its state or avoid resetting the monitor to 0 ?
Gil.
You can keep the state in your monitor implementation. Once you see the log message you report 0 and keep reporting 0 unless you see a different log message. Have a look at Manage and Develop User Plugins - it explains the lifecycle of a monitor plugin.
Andi
Still strugling ...
perhaps I'm missing something. since the monitor is runnign every x, I need to be able to only track changes (for example lines added to log file) during the interval. Performance wise it would be wrong to read all data from scratch each run. How would you suggest doing that ? are you familiar of any sample code/user plugin that is working similarily ?
Gil.
You should be able to keep some state information in your plugin, e.g: the last timestamp of the log message you processed. When you then read the file again you start from that position where you last stopped.
I do not have an example for this at hand
