Five Steps To Monitoring Your Server Log on IBM i

May 26, 2010 Pi Guang Ming

In today’s Web application environment, notices and error messages that appear in a Web server’s logging files can be easily lost or missed. This exposes you to missing important information that you may need to know.

The Web Log Monitor gives users the capability to monitor the contents of log files for any Web-related server, including the Integrated Web Application Server, Integrated Web Services Server, WebSphere Application Server, WebSphere Portal Server, and IBM‘s HTTP Server.

Users can set rules for the Web Log Monitor. If a situation matches the rule parameters, the monitor sends a notification to:

The *QSYSOPR system message queue
One or more e-mail addresses
Both the *QSYSOPR system message queue and e-mail addresses

In this way, the Web Log Monitor can help ensure that important messages are seen.

Web Log Monitor is included as a part of the IBM Web Administration for i Web Administration for i GUI interface. It inspects the log files as long as IBM Web Administration for i is started. The minimum OS supported is IBM i 6.1 at PTF SF99115 level 12 or higher.

Activating Web Log Monitor

You can configure and activate Web Log Monitor using following five steps.

Step 1. Open the Web Log Monitor main page.
Bring up the IBM Web Administration for i by accessing the URL: http://:2001/HTTPAdmin. Click the Manage tab, then click sub-tab Application Servers. You’ll see the link Web Log Monitor under the Problem Determination link in the left navigation panel. Click it and you’ll see Web Log Monitor introduction page, as shown in Figure 1 below.

Figure 1. Web Log Monitor Intro Page.

Step 2. Specify the log that you need to monitor,
Click on the Enable Web Log Monitor link. Then browse to find and select the log file. Only log files that you’re authorized to use will be shown in the pop-up browser window. Once you’ve selected the log file, click Next. Now you’ll see the Configure Rule page.

Step 3. Define the filter rule for your log file.
You can either use the Basic tab (as seen in Figure 2 below) to define basic filter rules like matching keywords, or the Advanced tab (see Figure 3) to define more complex rules, such as regular expressions.

Figure 2. Web Log Monitor Rule Configuration Page, Basic Tab.

Figure 3. Web Log Monitor Rule Configuration Page, Advanced Tab.

In the Basic tab, three modes of keyword rules filter the content of specified log file. To specify more than one keyword, use a comma or semicolon to separate them.

Match any keyword. For example, if the monitored file contains a line like “JVMDUMP0061 Processing Dump Event gpf, detail – Please Wait,” and the keywords specified here are “Dump, Failed, Error,” then the line is considered a match.
Match all keywords. For example, if the monitored file contains a line like “JVMDUMP0061 Processing Dump Event gpf, detail – Please Wait,” and the keywords specified here are “Dump,Event, Wait,” then this line is not considered a match since the white space or blank character in front of “Wait” is also treated as part of the keyword. If the specified keywords are “Dump,Event,Wait,” then this line is considered a match, as all three specified keys are in the line.
Keyword A + any string + Keyword B. For example, if the monitored file contains a line like “JVMDUMP0061 Processing Dump Event gpf, detail – Please Wait,” and the keywords specified here are “Dump” and “detail,” then this line is considered a match.

The Advanced tab specifies complex patterns to be used in the rule:

Exclude the following keywords: Specifies whether or not to ignore a line that contains any of the following keywords.
Configure regular expression: Gives users the capability to customize the rule with a regular expression.

If you have multiple log files to monitor, click on the Add button in the File and Rule tab as shown in Figure 4. Then repeat step 3.

Figure 4. Add multiple log files.

Step 4. Define where the notification text is sent when a match is found.
The next step is to tell Web Log Monitor what to do when it finds a match in your rules. You can do this by clicking on the Notification tab as show in Figure 5. Your choices are:

Send message to *QSYSOPR message queue. The notification text is sent to the *QSYSOPR system message queue when a match is found for a specified log file.
Send e-mail to a specific address. Notification is sent to the specified e-mail address. More than one e-mail address can be specified; use commas to separate multiple addresses.
Sender’s e-mail address. Specifies the e-mail address used to send the notification.
SMTP server. Specifies the Simple Mail Transfer Protocol (SMTP) server used to send the mail notification.
Account. Specifies the account used to log on to the SMTP server.
Password. Specifies the password of the account used to log on to the SMTP server.

Figure 5. Notification tab.

Step 5. Specify monitor interval and maximum number of notifications.
The Miscellaneous tab shown in Figure 6 lets you specify an interval in minutes and the maximum number of notifications to be sent per hour to prevent notification flood.

Figure 6. Miscellaneous tab.

Monitor interval. Specifies the frequency of checking the log file. Set the interval to a small value when log files are updated frequently and a large value when the specified log files are updated infrequently.
Notification flood prevention. Specifies the maximum permitted number of notifications to be sent per hour to prevent notification flood. If the specified maximum number is exceeded, no notification will be sent even when a match is found.

Note: Only users who have developer or higher authority can configure Web Log Monitor. For more information about roles, see User profile requirements to use the Web Administration for i interface.

Sample Notifications

Now that you’ve successfully enabled your Web Log Monitor, it will begin to send notifications according to your specifications. Figure 7 shows a sample of a *QSYSOPR message queue notification. The *QSYSOPR message queue notification contains related information such as the selected Web server’s instance name, time when this report is generated, and the full path of the monitored log file.

Figure 7. *QSYSOPR message queue notification.

Below is a sample notification sent via an e-mail message. This e-mail contains related information such as the target server host name, target selected Web server’s instance name, time when this report is generated, full path of the monitored log file, rule configured, and the content quoted from log file. The keyword specified in the example is “unknown,” and all the lines containing the keyword are marked.

This mail is a notification generated by Web Log Monitor.
Please do not reply this mail.

Web Log Monitor on server [d60b85ae.cn.ibm.com] has detected
the following problems:

Web Log Monitor on server [d60b85ae.cn.ibm.com] has detected
the following problems:

******** Web Log Monitor Report ********

* Server instance = stopIAS
* Time = Mon Aug 17 16:58:58 CST 2009

======== Log File ========
* File    :		 /www/stopIAS/lwi/logs/lwistderr.txt
* Rule    :		 .*(unknown).*
* Message :		 File /www/stopIAS/lwi/logs/lwistderr.txt has
                 something to be aware of.
-------- Message 0 --------
      > 2009/08/14 13:53:10.834 CONFIG eclipse.buildId=@buildId@
      > java.fullversion=J2RE 1.6.0 IBM J9 2.4 OS400 ppc-32 
	  jvmap3260sr3-20081105 (JIT enabled, AOT enabled)
      > J9VM - 20081105_025433_bHdSMr
      > JIT  - r9_20081031_1330
      > GC   - 20081027_AB
 X -- > BootLoader constants: OS=unknown
      > , ARCH=PowerPC
 X -- > , WS=unknown
      > , NL=en_US
      > Framework arguments:  -pluginCustomization rcp/plugin_
	  customization.ini -application com.ibm.lwi.application.
	  LWIApplication
      > Command-line arguments:  -pluginCustomization rcp/plugin_
	  customization.ini -data /www/stopIAS/lwi/runtime/core/
	  workspace/ -application com.ibm.lwi.application.LWIApplication 
	  -console -clean ::class.method=com.ibm.rcp.core.internal.logger.
	  frameworkhook.writeSession() ::thread=Start Level Event 
	  Dispatcher ::loggername=com.ibm.rcp.core.internal.logger.
	  frameworkhook
******** End of Web Log Monitor Report ********

Never Miss a Message

Web Log Monitor helps ensure you never miss an important message again. By configuring Web Log Monitor to generate a *QSYSOPR notification or an e-mail, you can stay on top of your notices and errors.

Pi Guang Ming is a software engineer for IBM’s i Web integration development team at the China System and Technology Lab. The i Web integration development team’s focus is on the Web-based management of middleware running on i, including WebSphere Application Server, WebSphere Portal Server, Integrated Web Services Server, Integrated Application Server, and the i HTTP server. Send your questions or comments for Pi to Ted Holt via the IT Jungle Contact page.

                     Post this story to del.icio.us
               Post this story to Digg
    Post this story to Slashdot