28.5 Monitoring Log Files

You can use Log File Monitoring to monitor WebLogic Server and Application Deployment log files for specific patterns. You can set up Cloud Control to receive alert notifications in the context of targets when patterns are found. This allows you to be more proactive and learn of problems as an administrator before end users discover them.

Use the following topics to learn how to set up and use Log File Monitoring:

28.5.1 About Log Viewer

Log Viewer enables administrators to view, search, and download middleware-related log files regardless of where the files reside on disk. Complex search criteria can be specified and saved for future reference in order to help administrators quickly diagnose performance problems across multiple middleware components spanning multiple Fusion Middleware Farms and WebLogic Domains.

Note:

If you want to use all features of the log viewer in Cloud Control, and the target domain for which you want to view log messages is SSL-enabled with a custom certificate, then log viewer features will not function properly. For most features of log viewer, the OMS makes a JMX connection to the Admin Server of that domain. The only log viewer feature that does not have the OMS make a direct JMX connection to the Admin Server is the feature used for archived log files. Instead, the agent is used for viewing archived log files.

For log viewer features to fully function in this environment, you must apply additional configuration changes.You must take the rootca of the custom certificate from the Admin Server target for the domain against which you want to view log messages and import it into the trust store of the OMS.

When accessing Log Viewer, default search criteria is specified for the selected target type. The administrator can then refine the search criteria based on diagnostic requirements for the particular Fusion Middleware Farm. By using the Add Fields button, you can refine the search criteria to include:

  • Selecting one or more member targets of the Fusion Middleware Farm

  • Specifying the date range

  • Selecting the message types

  • Specifying the messages to be searched

  • Specifying the ECIDs to be searched

  • Specifying the application name

  • Specifying the user name

Once the search criteria has been defined, the administrator clicks on the search button.

The administrator modifies the search as needed and clicks the Save Search button on the Log Viewer.

The search criteria specified, including the targets against which the search was performed, is then saved to the Management Repository for the currently logged in administrator.

You can click on the Saved Searches button to retrieve and apply a previously stored Search Criteria.

You can click on the Manage Saved Searches and bring up a pop-up to edit or delete the previously Saved Search Criteria.

28.5.2 Overview of WebLogic Server and Application Deployment Log File Monitoring

You can use Log File Monitoring to monitor WebLogic Server and Application Deployment log files for specific patterns and thereby reduce troubleshooting time. You can set up Cloud Control to receive alert notifications in context of targets when patterns are found.

The Log File Monitoring metric, Log File Pattern Matched Line Count for WebLogic Server and Application Deployment target types allows you to monitor one or more log files for the occurrence of one or more search patterns. In addition, you can specify a pattern to be ignored for the log file. Periodic scanning, which occurs by default every 60 minutes, is performed against any new content added since the last scan. Lines matching the ignore pattern are ignored first, then lines matching specified match patterns result in one record being uploaded to the repository for each pattern. You can set a threshold against the number of lines matching the given pattern. File rotation will be handled within the given file.

You can also use the monitoring templates functionality, which allows an administrator to configure a metric once in a template and then apply the template to several WebLogic Server or Application Deployment targets at once, rather than having to configure each WebLogic Server log file monitoring metric individually.

If you are currently using log file monitoring via the Host target type, you should configure log file monitoring via the Fusion Middleware related target type instead so you can see alerts in context of a Fusion Middleware target.

Prerequisites to Use Log File Monitoring

Log File Monitoring requires a local Management Agent monitoring target. In other words, the host on which the log files you want to monitor reside must have a Management Agent installed and running. The operating system user who installed the Management Agent must have read access to the directories where the monitored log files reside. Log file monitoring is disabled by default. You must enable it in order to use this feature.

28.5.3 Enabling Log File Monitoring

Log File Monitoring is disabled by default. To enable Log File Monitoring, follow these steps:

  1. From the target menu, select Monitoring.
  2. Choose Metric and Collection Settings.
  3. On the Metric and Collection Settings page, in the Metrics tab, from the View drop-down menu, select All metrics.
  4. Search for Log File Monitoring. Against the Log File Monitoring row, click the Disabled link.
  5. On the Edit Collection Settings: Log File Monitoring page, in the Collection Schedule section, click Enable. The default collection schedule is set for every 60 minutes.
  6. Click Continue.

    The Metric and Collection Settings page appears. At this point, Enterprise Manager Cloud Control enables Log File Monitoring but does not save the changes to the Management Repository.

  7. On the Metric and Collection Settings page, click OK.

    Enterprise Manager Cloud Control saves your changes to the Management Repository.

28.5.4 Configuring Log File Monitoring

To configure Log File Monitoring, follow these steps:

  1. From the target menu, choose Monitoring.

  2. From the Monitoring menu, select Metric and Collection Settings.

  3. On the Metric and Collection Settings page, in the Metrics tab, from the View drop-down menu, select All metrics.

  4. Search for Log File Monitoring.

  5. Under the Log File Monitoring row, in the Log File Pattern Matched Line Count row, click the Edit icon on the right.

  6. On the Edit Advanced Settings:Log File Pattern Matched Line Count page, in the Monitored Objects section, click Add to add new objects to specify settings for the log files to be monitored.

    The table in the Monitored Objects section lists all log file names, match patterns, and ignore patterns set for this metric. You can specify different threshold settings for each of the columns. The Reorder button specifies which log file to scan first.

    You can use a combination of wildcards and regular expressions to set your search criteria.

  7. In the Log File Name column, enter the log file name pattern you want to search for.

    When you use wildcards and/or regular expressions in the Log File Name column, make sure you use them only for identifying the log file names and not for identifying the location path of the log directory where the log files reside.

    For example,

    • If you provide /u01/domains/EMGC_DOMAIN/servers/EMGC_OMS1/logs/%.log, then all files that have the .log extension in the log directory are selected.

    • If you provide /u01/domains/EMGC_DOMAIN/servers/EMGC_OMS1/logs/%diagnostics%, then all files that have diagnostics in their file names in the log directory are selected.

    • If you provide /u01/domains/%_DOMAIN%/servers/EMGC_OMS1/logs/%diagnostics%, then it will be treated as an invalid pattern. Do not use wildcards to identify the log directory path.

  8. In the Match Pattern column, enter the match pattern that should be considered in the log file. You can use a combination of wildcards and regular expressions. Case is ignored.

    For example:

    • Set the match pattern as FATAL. This pattern will be true for any lines containing fatal.

    • Set the match pattern as %fatal%critical%. This pattern will be true for any lines containing fatal and critical.

  9. In the Ignore Pattern column, enter the pattern that should be ignored in the log file. By default, % appears in the column; you should remove the default value if nothing should be ignored. You can use a combination of wildcards and regular expressions. Case is ignored.

    • Set the match pattern as BEA-0023 and the ignore pattern as warning. This pattern searches for BEA-0023 but ignores it if the same line contains warning.

    • Set the match pattern as ADFC-1023%FAILED%. This pattern searches for ADFC-1023 only if it is followed by FAILED anywhere in the same line.

    • Set the match pattern as BEA-% and the ignore pattern as BEA-1005. This pattern searches for all patterns starting with BEA- but ignores BEA-1005.

  10. In the Warning Threshold and Critical Threshold columns, set the threshold values to a number such that if the pattern occurs in the log file the specified number of times within the collection schedule, then an alert will be triggered. If the number of occurrences is specified in the advanced settings, then this factors into when alert is raised.

    For example, if you set the critical threshold to 1 (if pattern found more than 1 time in log file, it is critical alert) and the number of occurrences to 2, then a critical alert is raised only when the pattern is found more than once in the log file within 2 consecutive collections.

Including the Log File Pattern Matched Line Count Metric As Part of a Monitoring Template

Once log file monitoring is enabled and configured, you can include the ‘Log File Pattern Matched Line Count' metric as part of a Monitoring Template. Log file locations must be the same across targets to which the template is applied. You can apply the template to multiple WebLogic servers or Application Deployment targets at once rather than setting monitoring settings individually on a per-target basis.

If after configuring the Log File Monitoring metric the log file contains the specified patterns but the alerts are not generated in the OMS, you should do the following:

  • Check whether the log file name contains a perl pattern.

  • Check whether the ignore pattern contains an asterisk (*). Providing an asterisk in the ignore pattern field will also ignore all the lines which include the matched patterns.

Configuration Issues

If an error message displays indicating that logging configuration is missing or invalid for certain targets, you can try the following options.

First, the WebLogic Domain that you are accessing may not be Oracle JRF (Java Required Files) enabled. Oracle JRF consists of components not included in the Oracle WebLogic Server installation and that provide common functionality for Oracle business applications and application frameworks. To view log messages, the target must be Oracle JRF enabled. To check to see if your WebLogic Domain, for example, is Oracle JRF enabled, perform the following steps:

  1. From the WebLogic Domain menu, select Target Setup submenu and then Monitoring Configuration.
  2. On the Monitoring Configuration page for the domain, look for the property labeled “Can Apply JRF". The value for this property could be true or false. If the value is false, then the domain is not Oracle JRF enabled.

If the value of the “Can Apply JRF" property is true for the domain, this does not necessarily mean that all managed servers within the domain are Oracle JRF enabled. If you are unable to access log messages in the context of a specific managed server, then navigate to the relevant managed server's Monitoring Configuration page. From the Monitoring Configuration page, look for the property “Is JRF Enabled". The value for this property could be true or false. If the value is false, then the managed server is not Oracle JRF enabled.

Second, the Enterprise Manager Cloud Control administrator who is trying to access log messages does not have the necessary target privileges to do so. In order to view log messages, the administrator must have been granted the target privilege “Ability to view Fusion Middleware Logs" for the corresponding target. Talk to your Oracle Enterprise Manager's site administrator or super administrator regarding whether you have this privilege or not. Refer to later questions in this document for additional details on this target privilege and granting the privilege to administrators.

28.5.5 Viewing Alerts from Log File Monitoring

Alerts generated from the Log File Pattern Matched Line Count metric appear on the home page of the target or the Alert History page.

Triggered alerts must be manually cleared.