Five steps to monitoring your server log on IBM i

In today’s Web application environment, notices and error messages that appear in the Web servers logging files can be easily lost or missed. This exposes you to missing important information that you may need to know.

 

The Web Log Monitor gives users the capability to monitor the contents of log files for any Web-related server, such as Integrated Web Application Server, Integrated Web Services Server, WebSphere Application Server, WebSphere Portal Server and IBM HTTP Server.

 

Users can set rules for the Web Log Monitor. If a situation matches the rules parameters, the monitor sends a notification to:

·        The *QSYSOPR system message queue

·        One or more e-mail addresses

·        Both the *QSYSOPR system message queue and e-mail addresses

 

In this way, the Web Log Monitor can help ensure that important messages are seen.

Web Log Monitor is included as a part of the IBM Web Administration for i GUI interface. It inspects the log files as long as IBM Web Administration for i is started. Minimum OS supported is IBM i 6.1 PTF SF99115 level 12 or higher.

 

Activating Web Log Monitor

You can configure and activate Web Log Monitor using following five steps:

 

Step 1—Open the Web Log Monitor main page

Bring up the IBM Web Administration for i by accessing URL http://<your_system>:2001/HTTPAdmin. Click tab Manage, then click subtab Application Servers. You’ll see the link Web Log Monitor under the Problem Determination link in the left navigation panel. Click it and you’ll see Web Log Monitor introduction page, as shown in Figure 1.

 

Figure1. Web Log Monitor Intro Page

Step 2—Specify the log that you need to monitor

Click on the Enable Web Log Monitor link. Then browse to find and select the log file. Only log files that you’re authorized to use will be shown in the pop-up browser window. Once you’ve selected the log file, click Next. Now you’ll see the Configure Rule page.

 

Step 3—Define the filter rule for your log file

You can either use the Basic tab (Figure 2) to define basic filter rules like matching keywords, or the Advanced tab (Figure 3) to define some complex rules like regular expression.

 

Figure2. Web Log Monitor Rule Configuration Page – Basic Tab

In the Basic tab, three modes of keywords rule filter the content of specified log file. To specify more than one keyword, use comma or semicolon to separate them.

 

·        Match any keyword. For example: If the monitored file contains a line like JVMDUMP0061 Processing Dump Event gpf, detail - Please Wait.” and the keyword specified here are “Dump, Failed, Error” then the line is considered a match.

·        Match all keywords. For example: If the monitored file contains a line like "JVMDUMP0061 Processing Dump Event gpf, detail - Please Wait." and if the keywords specified here are "Dump,Event, Wait" then this line is not considered a match since the white space or blank character in front of " Wait" is also treated as part of the keyword. If the specified keywords are "Dump,Event,Wait" then this line is considered a match as all three specified keys are in the line.

·        Keyword A + any string + Keyword B. For example: If the monitored file contains a line like "JVMDUMP0061 Processing Dump Event gpf, detail - Please Wait." and the keywords specified here are "Dump" and "detail" then this line is considered a match.

 

 

 

Figure3. Web Log Monitor Rule Configuration Page – Advanced Tab

The Advanced tab specifies complex patterns to be used in the rule:

 

·        Exclude the following keywords: specifies whether or not to ignore a line that contains any of the following keywords.

·        Configure regular expression: Gives users the capability to customize the rule by a regular expression.

If you have multiple log files to monitor, click on the Add button in the File and Rule tab as shown in Figure 4. Then repeat step 3.

  

Figure4. Add multiple log files

Step 4—Define where the notification text is sent when a match is found

The next step is to tell Web Log Monitor what to do when it finds a match in your rules. You can do this by clicking on the Notification tab (Figure 5). Your choices are:

 

 

Figure5. Notification tab

·        Send message to *QSYSOPR message queue. When selected, the notification text is sent to the *QSYSOPR system message queue when a match is found for a specified log file.

·        Send e-mail to a specific address. When selected, notification is sent to the specified e-mail address. More than one e-mail address can be specified; use commas to separate multiple addresses.

·        Sender’s e-mail address. Specifies the e-mail address used to send the notification.

·        SMTP server. Specifies the Simple Mail Transfer Protocol (SMTP) server used to send the mail notification.

·        Account. Specifies the account used to log on to the SMTP server.

·        Password. Specifies the password of the account used to log on to the SMTP server.

 

Step 5—Specify monitor interval and maximum number of notifications

The Miscellaneous tab (Figure 6) lets you specify interval in minutes and maximum number of notifications to be sent per hour to prevent notification flood.

   

Figure6. Miscellaneous tab

·        Monitor interval. Specifies the frequency of checking the log file. Set the interval to a small value when log files are updated frequently and a large value when the specified log files are updated infrequently.

·        Notification flood prevention. Specifies the maximum permitted number of notifications to be sent per hour to prevent notification flood. If the specified maximum number is exceeded no notification will be sent even when a match is found.

Note: Only users who are developer or higher authority can configure Web Log Monitor.

 

Sample Notifications

Now you’ve successfully enabled your Web Log Monitor and it will begin to send notifications according to your specifications. Figure 7 shows a sample of a *QSYSOPR message queue notification. The *QSYSOPR message queue notification contains related information such as target the selected Web server’s instance name, time when this report is generated, full path of the monitored log file, etc.

 

 

Figure7. *QSYSOPR message queue notification 

The following shows a sample notification via an e-mail message. This e-mail contains related information such as the target server host name, target selected Web server’s instance name, time when this report is generated, full path of the monitored log file, rule configured, content quoted from log file, etc. The key word specified in the example is “unknown” and all the lines containing the key word are marked.

This mail is a notification generated by Web Log Monitor. Please do not reply this mail.
Web Log Monitor on server [d60b85ae.cn.ibm.com] has detected the following problems:

Web Log Monitor on server [d60b85ae.cn.ibm.com] has detected the following problems:
******** Web Log Monitor Report ********
* Server instance = stopIAS
* Time = Mon Aug 17 16:58:58 CST 2009
======== Log File ========
* File    :           /www/stopIAS/lwi/logs/lwistderr.txt
* Rule    :          .*(unknown).*
* Message :          File /www/stopIAS/lwi/logs/lwistderr.txt has something to be aware of.
-------- Message 0 --------
      > 2009/08/14 13:53:10.834 CONFIG eclipse.buildId=@buildId@
      > java.fullversion=J2RE 1.6.0 IBM J9 2.4 OS400 ppc-32 jvmap3260sr3-20081105 (JIT enabled, AOT enabled)
      > J9VM - 20081105_025433_bHdSMr
      > JIT  - r9_20081031_1330
      > GC   - 20081027_AB
 X -- > BootLoader constants: OS=unknown
      > , ARCH=PowerPC
 X -- > , WS=unknown
      > , NL=en_US
      > Framework arguments:  -pluginCustomization rcp/plugin_customization.ini -application com.ibm.lwi.application.LWIApplication
      > Command-line arguments:  -pluginCustomization rcp/plugin_customization.ini -data /www/stopIAS/lwi/runtime/core/workspace/ -application com.ibm.lwi.application.LWIApplication -console -clean ::class.method=com.ibm.rcp.core.internal.logger.frameworkhook.writeSession() ::thread=Start Level Event Dispatcher ::loggername=com.ibm.rcp.core.internal.logger.frameworkhook

******** End of Web Log Monitor Report ********