Monitoring log file, and alerting when no new logs in x time

Started by Egert143, June 25, 2024, 09:13:03 AM

Previous topic - Next topic

Egert143

Hello

Is it possible to monitor windows log file for specific log, example "C:\ProgramData\Program1\Logs\log1.log", that contains 1 new entry every time that program succesfully runs. i would like to get notified when there has not been new log entry in X ammount of time. And to make matters more fun, there can be different log lines, but i am looking for specific content.

Demo line: "2024-06-25 08:59:39.677+03:00 [    61] INFO      - RuleProcessor starting to execute rule action. Rule: 45df1829-4617-4a39-8933-36799aa6f466 (! TEST !); ActionName: VideoOS.Server.RuleActions.LogServerEntryRuleAction"

Alex Kirhenshtein

There are multiple approaches, but I preffer this one:

in EPP set custom attribute on the node with timestamp of the last log event (either via script action, or directly in rule's filter script), then add scheduled task with the script, which iterates over nodes and check if time in custom attribute is older than a threshold. If it's too old - use PostEvent to inject another event in to the system.