NetXMS Support Forum

Calling for the instance as a variable in the action is what I was missing. That did the trick, thanks!

A quick follow-up question: can I use a single event processing item to monitor and restart multiple different programs on the same node?

I want to ensure that program A and B are always running. Is it possible to use filtering scripts in event processing to filter out actions based on certain criteria? Can I use the same processing item to say "if program A stops, run action to restart program A and do NOT run action to restart program B" or do I need to create two different processing items for this?

That worked! Thanks for the help!

I have NetXMS setup to alert me if a particular program stops running but I'd also like it to restart the program automatically when it detects that it is not. I was able to configure this action successfully but NetXMS is running as a service so it restarts the program as a background process. I need the program's GUI to be presented to the logged in user. I understand this is possible by setting up a subagent running it as the logged in user and connecting it to the main agent running as a service but it isn't clear to me how to do this exactly. The documentation only mentions it briefly. Can anyone offer clarification on creating a subagent running as a different user? Is there a better way to restart a program with a GUI than this method?

The filtering script would completely suppress additional alerts though, correct? I still want to see every matched string because they will contain unique information, but if two of them occur in the same log file back-to-back, I'd like it grouped into a single email.

I will have to do testing with the DCI checking log file modification time and see if that works for me.

Thanks. That makes sense. I was able to get it monitoring a couple different dynamically changing files using time/date macros and parsing the files separately.

I did have a couple of follow up questions that I haven't been able to find a solution to:

I currently have the parser and actions setup to monitor the logs for a specific string, and if it finds it, it emails me the line from the log containing the string. If the string occurs twice in immediate succession, it will send me two separate emails. Is there a good way to group event notification emails when the event occurs multiple times in quick succession?

How would I set up the parser to trigger an event if the log hasn't been written to after a set amount of time? Is this possible?

Thank you for the response. That explains the trouble I've been having! So, essentially, I would need to create a script to generate a list of log files to parse? What would be the syntax of inserting the output of that script into the parser? Would it be best to create the script somewhere within NetXMS and point the parser to it, or does it need to be done externally using Powershell or a batch file?

I am trying to create a log parser that will alert me when it detects the string "***" in any of a series of log files. I have managed to get it working if I point it specifically at a single log file, but when I try to use a macro to have it parse all of the files in a folder, I am running into trouble. My parser code is as follows:


<parser trace="0" name="*** Monitor">
   <file>D:\program\log\@{log}</file>
   <rules>
      <rule name="Log Monitor">
         <match repeatCount="0" repeatInterval="1">\*\*\*</match>
         <event>LOGWATCH_TEST</event>
         <logName></logName>
      </rule>
   </rules>
   <macros>
      <macro name="log">.*\.log</macro>
   </macros>
</parser>


Can anyone help me understand what I'm doing wrong here? Part of the trouble I'm running into is when I make XML edits, the system seems to automatically revert and change some of them even when I save changes. For instance, it keeps automatically moving the "macros" section below the rules section but the documentation for NetXMS specifies the macros section should come first. It also keeps on adding in the "logName" tag below the event tag? I don't know what this tag is but even when I remove it, it comes back. Is this intended behavior?