This discussion is archived
1 Reply Latest reply: Sep 9, 2011 2:52 AM by RenévanWijk RSS

Why isn't my log watch matching and sending me email?

david.karr Pro
Currently Being Moderated
I'm trying to create a log watch so I can be notified when particular patterns of log entries appear. The pattern is appearing in the log file, and I see some of the wldf debugging messages that I enabled, showing that it's at least trying to do something, but the expression doesn't seem to match, and I don't get email.

An abbreviated example of the log message I want to check for is this:

####<Sep 8, 2011 12:44:38 PM PDT> <Notice> <Stdout> <myhost> <AdminServer> <[ACTIVE] ExecuteThread: '3' for queue: 'weblogic.kernel.Default (self-tuning)'> <<WLS Kernel>> <> <> <1315511078074> <BEA-000000> <[[ACTIVE] ExecuteThread: '3' for queue: 'weblogic.kernel.Default (self-tuning)'] WARN mypackage - No defined service for handler "stuff".>

I want to check for the "No defined service for handler" string. This message is emitted by Log4J in my application, and I'm filtering stdout and stderr to the server log (through the settings in the Logging area of the server definition).

I configured a mail session to go to our SMTP host.

I created a new diagnostic module, with a notification using that mail session, and going just to my email address. I created a watch of type "Server Log" and I set it to Enabled. I've targeted the module to my admin server. I've set the "Severity" and "Log Watch Severity" to "Info". My watch rule is just this:

(MESSAGE LIKE 'No defined service for handler')

I'm not using an alarm, and I set the notification for the watch to the one I just created.

I also enabled the debug flag "DebugDiagnosticWatch".

I see log messages like this that show it trying to do this matching:

####<Sep 8, 2011 12:44:38 PM PDT> <Debug> <DiagnosticWatch> <myhost> <AdminServer> <[STANDBY] ExecuteThread: '4' for queue: 'weblogic.kernel.Default (self-tuning)'> <<WLS Kernel>> <> <> <1315511078074> <BEA-000000> <Evaluating watch Watch: unmatched handler rule: (MESSAGE LIKE 'No defined service for handler') ruleType: 1 severity: 64 alarmType: 0 alarmReset: 60000 state: 0 notifications: me>
####<Sep 8, 2011 12:44:38 PM PDT> <Debug> <DiagnosticWatch> <myhost> <AdminServer> <[STANDBY] ExecuteThread: '4' for queue: 'weblogic.kernel.Default (self-tuning)'> <<WLS Kernel>> <> <> <1315511078074> <BEA-000000> <Evaluated watch unmatched handler to false for LogEntry [[ACTIVE] ExecuteThread: '3' for queue: 'weblogic.kernel.Default (self-tuning)'] WARN com.att.sunlight.service - No defined service for handler "stuff".>

I don't see a log message that clearly states it's going to send a notification, so I think it didn't match for some reason.

I also enabled the "mail.debug" flag in the mail session properties, so I would see if it was trying to send email.

Legend

  • Correct Answers - 10 points
  • Helpful Answers - 5 points