The Log Central Console is a graphical user interface that provides your main point of access for controlling the flow of information in Log Central, monitoring incoming log messages, and carrying out other management tasks. The Console consists of a set of tools that you can access from the Log Central Launch Panel.
This chapter covers the following topics:
To invoke the Log Central Console, type When you start the Console, the Launch Panel appears first. The Launch Panel provides access to the Console tools of Log Central.
You can also invoke the Console with a number of options. You may want to specify any of the following:
Invoking the Launch Panel
lc_launch at a command prompt on the central host.
To change any of the where:
lc_launch defaults, use the following syntax:
lc_launch [-p
port] [-h central_host] [-n msgs] [-fn fontname]
[-fs fontsize] [-b browser]
port
central_host
msgs
fontname
fontsize
browser
The Message Browser displays Log Central messages that are generated by the resources you are monitoring. Invoke the Message Browser main window by selecting the Msg Browser button on the Launch Panel.
The subjects discussed in this section are as follows:
Figure 9-1 shows the basic look and presentation of the Message Browser main window.
Table 9-1 describes the fields of this window.
Table 9-2 describes the Message Browser toolbar buttons available for frequently used actions.
Note:
All options other than Stop and Help are grayed out if the Browser is either actively receiving incoming messages or is carrying out a database query. Select Stop to access the other options.
You can monitor log messages "in real time" as they arrive at the Central Collector. To monitor incoming messages, perform the following steps:
Message Browser Main Window
Figure 9-1 Message Browser Main Window
How to Monitor Incoming Messages
Alternatively, you can select the Online Monitoring radio button on the Filter Settings window, and then select Start from the toolbar when you return to the Message Browser main window.
Messages are retrieved that satisfy the filter settings defined in the Filter Settings window.
The scrollable display in the main window accumulates incoming messages until it contains its maximum number of messages. At that point, the oldest messages are dropped from the display as new messages arrive. New messages appear at the top of the tabular list.
To filter incoming messages, see "How to Filter Messages."
You can search the Log Central database for log messages that match criteria that you define. To do a historical query of the message database, perform the following steps:
To filter historical queries, see "How to Filter Messages."
Alternatively, you can select the Historical Query radio button on the Filter Settings window, and then select Start from the toolbar when you return to the Message Browser main window.
Messages are retrieved that satisfy the filter settings defined in the Filter Settings window.
The default is for retrieved messages to appear on your screen in chronological order, with the most recent at the top of the screen, from the last query made. You can change this default with filtering, as described in "How to Filter Messages."
From the Message Browser main window, you can delete a log message as follows:
Delete from the Message Browser main window, as shown in
Figure 9-2.
A submenu allows you to delete either the current message or all messages that were returned in the last query.
Figure 9-2 Selecting Delete from the Message Browser Main Window
When messages arrive at the Central Collector, they are by default not acknowledged. You can change the acknowledged value to "Yes" from the Message Browser. A typical use for this attribute is to chart which system problems are currently being resolved or actively investigated.
From the Message Browser main window, you can acknowledge a log message as follows:
A submenu allows you to change the acknowledgment of either the current message or all main window messages retrieved in the last query.
Once the message has been acknowledged, "Yes" appears in the Acknowledged column.
Figure 9-3 Selecting Actions
Acknowledge from Message Browser Main Window
From the Message Browser main window, you can change the acknowledgment of a log message from "Yes" to "No" as follows:
Clear Acknowledge.
A submenu allows you to change the acknowledgment of either the current message or all main window messages retrieved in the last query.
Once the acknowledgment of the message has been removed, "No" appears in the Acknowledged column.
You can use filters to specify selection criteria to:
From the Message Browser main window, you can filter log messages as follows:
Alternatively, you can select the Settings The Filter Settings window appears on the screen, as shown in Figure 9-4.
From the Filters Settings window, you can switch between online message monitoring and historical queries of the Log Central database.
Browser Filter menu option.
Figure 9-4 Filter Settings Window
To filter incoming messages, select Online Monitoring. To filter messages already stored in the Log Central database, select Historical Query.
If you select Online Monitoring, the date and sorting sections of the form are grayed out, as shown in Figure 9-5.
Select the sort order for messages retrieved in historical database queries. You can nest up to three sorts, mixing ascending and descending sort order.
Figure 9-5 Filter Settings Window with Portions Grayed Out
For example, the Subsys tab displays a list of the subsystem entries in the Log Central database, and you can use the buttons between the two windows (Include List and Exclude List) to move selections from one window to the other, or delete selections.
Figure 9-6 shows the LM subsystem in the exclude list and NT selected and ready to be moved to the exclude list.
For other tabs, enter your specification in the field above the two list boxes, and use the appropriate button between the list windows to move this specification to the list you want. For example, Figure 9-7 shows the Msg ID tab selected and message 90000 entered.
Figure 9-8 shows this message moved to the include list.
Figure 9-6 Filter Settings Window, Include and Exclude Selections
Figure 9-7 Filter Settings Window, Include Selection
Figure 9-8 Filter Settings Window, Include Selection Made
For Use Include List, the specified features are used to determine which messages to display. For Use Exclude List, those messages that meet the selected criteria are specifically excluded from the display.
From the Message Browser main window, you can change the layout to define which log attributes are displayed in the main window or to change the order of the attributes in the tabular display:
Alternatively, you can select the Settings The Layout window appears on the screen.
Layout Definition menu option.
Figure 9-9 Message Browser Layout Window
You can move components into the appropriate column by selecting the Show or Hide arrows on the main Layout window. You can move components up and down with the blue arrows to the right. The order you specify in the Show panel determines the order these columns appear in the message panel of the Message Browser main window, shown in Figure 9-1.
By default, messages appear in the Message Browser main window in different colors, depending on severity. For example, you might want messages of critical severity to appear in red, warnings in yellow, and so on. The default color-mapping is as follows.
| Severity | Color |
|---|---|
|
Informational |
Green |
|
Warning |
Yellow |
|
Minor |
Blue |
|
Major |
Magenta |
|
Critical |
Red |
To change the mapping of colors to indicate message severity level:
Alternatively, you can select the Settings The Color Settings window appears on the screen.
Message Colors menu option.
Figure 9-10 Message Browser Color Settings Window
As you move the sliders, the color in the Color column changes.
Note:
If you do not want to map colors to severity levels, select the None radio button.
Message definitions are stored in the Log Central database. These message definitions are described in Chapter 5, "Creating and Loading Message Definitions." You can access this message detail information for a particular message, such as a description of the event that triggered the message and recommended action to resolve a problem condition.
Message Details from the Message Browser main window.
You can generate two types of reports from the Message Browser:
For both, the Message Browser uses the current filter criteria, as defined in the Filter Settings window, to select messages on which to generate a report. The generated report is an HTML file created in To view summary reports in the Message Browser, perform the following steps:
install_dir\web\applet (install_dir/web/applet on UNIX), where install_dir is the directory in which you installed Log Central. Viewing this file requires a Web browser. Make sure that you have made a Web browser accessible to the Console. For information on how to do this, refer to "Invoking the Launch Panel."
How to View Summary Reports
Figure 9-11 shows a message selected, and the summary reports option chosen.
A Web browser window appears, displaying the requested report.
Figure 9-11 Message Browser Window, Choosing Summary Report
Figure 9-12 Message Browser Summary Report
To view detail reports in the Message Browser, perform the following steps:
A Web browser window appears, displaying the requested report.
Figure 9-13 Message Browser Window, Choosing Detail Report
Figure 9-14 Message Browser Detail Report
Message definitions provide static information about messages that may be generated by various applications. These message definitions are described in Chapter 5, "Creating and Loading Message Definitions." The Message Definition Editor allows you to create or modify message definitions one at a time. This is particularly useful if you already have an existing stock of definitions in the database and want to add a new definition on the fly.
To load many message definitions in a single action, you may find it more efficient to use the command-line utilities provided with Log Central. Messages are imported from an ASCII text file using the command-line utility msgdef_import. Message definitions in the text file must conform to the format used in the message definition template (msgdef.template) provided with Log Central. Messages can also be exported from the database to an ASCII text file using the command-line utility msgdef_export. For more information on these utilities, refer to Chapter 5, "Creating and Loading Message Definitions."
Invoke the Message Definition main window by selecting the Msg Def Edit button from the Launch Panel.
The subjects discussed in this section are as follows:
Figure 9-15 shows the basic look and presentation of the Message Definition main window.
Figure 9-3 describes the fields of this window.
Table 9-4 describes the Message Definition toolbar buttons available for frequently used actions.
To display message definitions, select the Start button from the Message Definition main window. This brings up a list of message definitions in the scrollable display window, according to the filtering criteria. For more information, see "How to Define Filtering Criteria for Retrieving Message Definitions."
Message Definition Main Window
Figure 9-15 Message Definition Main Window
How to Display Message Definitions
How to Add a New Message Definition
New Message Definition.
This brings up the Message Definition Details window, shown in Figure 9-16.
Alternatively, you can double-click on any message definition, and then select the File
New menu option.
Figure 9-16 Message Definition Details Window
The Subsystem Name pulldown displays a list of subsystems in the Log Central database. To add a new subsystem entry, use the If you want to have a script or file execute when the Central Collector loads the specified message into the Log Central database, specify it in the Execute on Upload field.
Figure 9-17 shows a filled-out form.
subsystem_create command, described in Chapter 3, "Configuring the Database for Use with Log Central."
Figure 9-17 Message Definition Details Form Filled Out
From the Message Definition main window, you can modify an existing message definition:
The Message Definition Details window appears with the fields filled in for the specific message definition.
From the Message Definition main window, you can delete a message definition in two ways, as follows:
Delete from the Message Definition main window.
Alternatively:
The Message Definition Details window appears.
Delete from the Message Definition Details window.
You can use filters to specify selection criteria to define which message definitions are selected for display.
From the Message Definition main window, you can filter message definitions as follows:
Alternatively, you can the select Settings The Message Definition Filter Settings window appears on the screen, as shown in Figure 9-19.
Editor Filter menu option.
Figure 9-19 Message Definition Filter Settings Window
Operations in these tabs are similar to those discussed under "How to Filter Messages," in the Message Browser section.
For Use Include List, the specified features are used to determine which message definitions to display. For Use Exclude List, those message definitions that meet the selected criteria are specifically excluded from the display.
From the Message Browser main window, you can change the layout to define which message definition attributes are displayed in the main window or to change the order of the attributes in the tabular display:
Alternatively, you can select the Settings The Message Definition Editor Layout window appears on the screen, as shown in Figure 9-20.
Layout Definition menu option.
Figure 9-20 Message Definition Editor Layout Window
You can move components into the appropriate column by clicking the Show or Hide arrows on the main Layout window. You can move components up and down with the blue arrows to the right. The order you specify in the Show panel determines the order these columns appear in the message panel of the Message Browser main window, shown in Figure 9-15.
Note:
If you want these selections as your default settings, select Default on the Layout window.
Message definitions appear in the Message Definition main window in different colors, dependent on severity. For example, you might want message definition of critical severity to appear in red, warnings in yellow, and so on. The default color-mapping is as follows.
| Severity | Color |
|---|---|
|
Informational |
Green |
|
Warning |
Yellow |
|
Minor |
Blue |
|
Major |
Magenta |
|
Critical |
Red |
To change the mapping of colors to indicate message severity level:
Alternatively, you can select the Settings The Color Settings window appears on the screen, as shown in Figure 9-21.
Message Colors menu option.
Figure 9-21 Message Definition Editor Color Settings Window
As you move the sliders, the color in the Color column changes.
Note:
If you do not want to map colors to severity levels, select the None radio button.
You can modify the subsystem description associated with a subsystem name:
Subsystem Definition from the Message Definition main window.
The Subsystem Definition window appears on the screen, as shown in Figure 9-22.
Figure 9-22 Subsystem Definition Window
The red X undoes the change.
You can generate two types of reports from the Message Definition Editor:
For both, the Message Definition Editor uses the current filter criteria to select messages on which to generate a report. The generated report is an HTML file created in To view summary reports in the Message Definition Editor, perform the following steps:
install_dir\web\applet (install_dir/web/applet on UNIX), where install_dir is the directory in which you installed Log Central. Viewing this file requires a Web browser. Make sure that you have made a Web browser accessible to the Console. For information on how to do this, refer to "Invoking the Launch Panel."
How to View Summary Reports
Reports Summary, as shown in Figure 9-23.
A Web browser window appears, displaying the requested report, as shown in Figure 9-24.
Figure 9-23 Message Definition Window, Choosing Summary Report
Figure 9-24 Message Definition Summary Report
To view detail reports in the Message Definition Editor, perform the following steps:
Reports Details, as shown in Figure 9-25.
A Web browser window appears, displaying the requested report, as shown in Figure 9-26.
Figure 9-25 Message Definition Window, Choosing Details Report
Figure 9-26 Message Definition Details Report
You can configure the Central Collector to send SNMP trap notifications based on one (or both) of the following attributes in the message definition for the incoming message:
If you enable trap generation based on the Trap Enabled field in the message definition, a trap is generated for any message whose definition has Trap Enabled set to Invoke the Basic Trap Configuration window by selecting the
The subjects discussed in this section are as follows:
YES.
Basic Trap button from the Launch Panel.
To enable trap generation by severity, do the following:
Configuring Trap Generation by Severity
Figure 9-27 Basic Trap Configuration, Trap Generation Tab
If you choose to enable any severity listed on this page, then any message having that severity prompts an SNMP trap.
Figure 9-28 shows an example of the Trap Configuration tab filled out.
This enterprise-specific trap number is included in the SNMP trap packet sent for messages with the indicated severity. SNMP has no concept of the severity of an event and no special field is provided for severity in the SNMP trap packet. However, by assigning a different enterprise-specific number to the different severities, system administrators can map the Log Central traps to severities on their enterprise-management system.
Figure 9-28 Basic Trap Configuration, Trap Configuration Tab
To enable trap generation by message definition, do the following:
You can configure the Central Collector to send SNMP traps based on both severity and message definition. In that case, you do not need to set the ID of Resulting Trap field on the Trap Configuration tab (Step 5 under "Configuring Trap Generation by Severity") because the specific trap number is determined by the message definition.
To enable trap generation by message definition, do the following:
Figure 9-29 Trap Generation Tab: Severity and Message
The Log Central Central Collector creates several intermediate files (one intermediate file per hour) that need easy management and pruning. The number of messages in the database can also grow rapidly. The Storage Maintenance tool eases the management of these files and messages, allowing you to set up periodic processing and deletion of files and messages.
Invoke the Storage Maintenance main window by selecting the Storage Maint button from the Launch Panel.
The subjects discussed in this section are as follows:
When the Storage Maintenance main window first appears, the Messages in Database tab is selected, as shown in Figure 9-30.
This displays a representation of the number of messages delivered during each hour of the day. The date appears on each line in the following format:
As, for example:
which means during the 2 to 3 p.m. time period on October 12. (The hour is in 24-hour representation.) During that hour, three messages were stored in the database.
Figure 9-31 shows the Storage Maintenance main window with the Intermediate Message Files tab selected.
Each file name represents one hour of the day. The file name consists of the intermediate file prefix, plus a date and time representation similar to the Messages in Database format. For example, the file name corresponding to The toolbar is below the menu bar. Table 9-5 describes the Storage Maintenance toolbar buttons available for frequently used actions.
You can have Log Central execute a script of your choosing on its intermediate files and on messages in the database. Log Central includes a sample script that you modify for your purposes.
To tailor this script to your specifications, perform the following steps:
Storage Maintenance Main Window
Figure 9-30 Storage Maintenance Main Window
YYYY MMDD HH
1998 Oct12 14
Figure 9-31 Storage Maintenance Main Window, Intermediate Message Files Tab
1998 Oct12 14 might be lclog.1998-Oct12-14.DB. The current file is called lclog.cur.
How to Prepare the Records Processing Script
install_dir\bin\process_dbrec.bat
(install_dir/bin/process_dbrec on UNIX), where install_dir is the
directory in which you installed Log Central.
The process_dbrec script ships as a sample file-a shell script on UNIX machines or a batch file on Windows NT-with comments describing how to use it (but it does not actually do anything as shipped). The Operations Settings window allows you to specify how frequently to execute the script, or whether to even execute it at all. You can also process selected records manually using the Process Records option of the File menu. The script is invoked for the selected database records when you select this option. As a Log Central administrator, you will want to tailor this file to your specifications.
Some of the things you could do using the process_dbrec script include:
The The Start time. Specifying 0 here means process all records before End time.
Your program can use these parameters as needed. It could also ignore them entirely.
Log Central expects your program to return -1 if there is an error and 0 if it runs successfully. Only if the return value is 0 are records deleted after the
Note:
Do not put any commands into the Based on the specifications you made in the Operations Settings You can have the Storage Maintenance tool delete records from the Log Central database according to a schedule you determine by performing the following steps:
process_dbrec command uses the following syntax:
process_dbrec
starttime endtimeprocess_dbrec options definitions follow.
Argument
Description
starttime
endtime.
endtime
process_dbrec script runs, even if you have selected the Delete Records option.
process_dbrec script that write to standard out (such as echo). The standard out terminal is not available in this context.
Example
window, Log Central might execute the script as follows:
process_dbrec "3-FEB-98 11:00" "4-MAR-98 19:00:00"
How to Schedule Deletion of Database Records
This brings up the Operations Settings Alternatively, you can select the Settings window, with the Messages in Database tab selected.
Operations menu option.
Figure 9-32 Storage Maintenance Main Window, Delete Records
If you want to perform the operation once only, deselect the Repeat Every checkbox.
Enter a number in the first field, and then select a time unit from the pulldown menu in the second field.
As in step 5, enter a number in the first field, and then select a time unit from the pulldown menu in the second field. If you choose, for example, Older Than 2 weeks, and your operation is scheduled weekly, a record that is 2 weeks and 1 hour old at the time the operation is invoked would not be deleted, but it would be the next time.
You can have the Storage Maintenance tool execute the process_dbrec script on individually selected records on a "one-shot" basis by performing the following steps:
This operation is not valid in the Intermediate Message Files tab.
Process Records, as shown in Figure 9-33.
This causes the Figure 9-33 Storage Maintenance Main Window, Process Records
process_dbrec script to be executed immediately on the selected records.
You can have the Storage Maintenance tool execute the process_dbrec script on selected records according to a schedule you determine by performing the following steps:
This brings up the Operations Settings Alternatively, you can select the Settings window, with the Messages in Database tab selected.
Operations menu option.
Figure 9-34 Operations Settings Window, Records Processing
If you want to perform the operation once only, deselect the Repeat Every checkbox.
Enter a number in the first field, and then select a time unit from the pulldown menu in the second field.
As in step 5, enter a number in the first field, and then select a time unit from the pulldown menu in the second field. If you choose, for example, Older Than 2 weeks, and your operation is scheduled weekly, a record that is 2 weeks and 1 hour old at the time the operation is invoked would not be deleted, but it would be the next time.
You can have the Storage Maintenance tool execute the process_dbrec script on selected records, followed by deletion of those records from the Log Central database, according to a schedule you determine by performing the following steps:
This brings up the Operations Settings Alternatively, you can select the Settings window, with the Messages in Database tab selected.
Operations menu option.
Figure 9-35 Operations Settings Window, Records Processing and Deleting
If you want to perform the operation once only, deselect the Repeat Every checkbox.
Enter a number in the first field, and then select a time unit from the pulldown menu in the second field.
As in step 5, enter a number in the first field, and then select a time unit from the pulldown menu in the second field. If you choose, for example, Older Than 2 weeks, and your operation is scheduled weekly, a record that is 2 weeks and 1 hour old at the time the operation is invoked would not be deleted, but it would be the next time.
You can have the Storage Maintenance tool delete intermediate files according to a schedule you determine by performing the following steps:
This brings up the Operations Settings Alternatively, you can select the Settings window, with the Messages in Database tab selected.
Operations menu option.
Figure 9-36 Operations Settings Window, Intermediate Message Files Tab
Enter a number in the first field, and then select a time unit from the pulldown menu in the second field.