# Log File Analysis
This package contains the basis for monitoring information extracted from a log file.
This package can be configured to receive filtered lines from log files monitored by a ServicePilot Agent.
To extract indicators to be plotted and monitored, a regular expression specified that can then extract details from the filtered and reported log lines.
Network Flows - It is mandatory that the network continuity is ensured. In case of a network infrastructure using a firewall, all the ports below must be opened
- ServicePilot Manager Web server access (by default TCP/80 when using HTTP or TCP/443 when using HTTPS although this port is configurable): Between ServicePilot Agent and ServicePilot Manager
- ServicePilot Manager minimum version: 8.5
- ServicePilot Agent minimum version: 8.5 installed and configured
Before adding a resource to monitor, make certain that all pre-requisites are in place and if a ServicePilot Agent is required, that it is communicating correctly with the ServicePilot Manager.
Add resource using Views Configuration web interface
- As an administrative user of ServicePilot, open the ServicePilot web interface.
- Navigate to Administration. The Configuration > Views web page will open.
- Click on the view in which to place the new resource in the Views hierarchy on the left of the interface. The View editor section will show the existing view contents.
- From the Packages list on the right of the interface, click and drag the log-file-analysis package into the View editor and let go.
- The Resource properties dialog box will open to allow resource configuration.
- Click OK to close the Resource properties dialog box. Note that the dialog box will not close if required parameters are not set.
- Click Save to apply the new resource to ServicePilot configuration.
Key field notes
In the Monitoring Policies tab, specify the policy or policies to apply to the resource
Log File Parameters tab:
- Log File Path: The full path to the log file to monitor.
- Treatment: Specify if the log file is always written sequentially or if new data can be added back at the begninning of the file when it is full.
Parsing Parameters tab:
- Only extract lines containing: Only capture log lines that contain this key string. If blank, all lines are collected.
- Polling Interval (sec): Specify the time interval (in seconds) at which ServicePilot will poll the log file for new lines (default 60).
- Indicator Extraction Type: Either a regular expression can be used to extract indicators or a list of indicator extraction definitions can be used.
- Data #: A comma separated list of elements used to search of an indicator in the resulting web page. The first element is a quoted search string. The second parameter is the number of delimiters from 0 upwards to skip after the search string. The third parameter is the length of the element to extract (set to 0 to take characters between two delimiters). The next parameter is yes if numeric conversion is requested or no otherwise. The last parameter is a | separated list of hexadecimal ASCII character codes defining the delimiters.
- Regex: A regular expression pattern match. The brackets in the pattern match will be used to fill in the indicator number specified by the ? placeholders. Indicators go from 1 up to 5.
- The ServicePilot Agent must be installed on a server with access to the log files. It is highly recommended that this be the server that generating the logs rather than a remotely accessed file.