> #### Creating search criteria

> You create the search criteria phrases to be accessed by and shared among several log file monitors from the Fathom library. These search criteria phrases, along with the severity level and alert detail you define, are the rule properties you use to create log file resource monitor rules and rule sets.

> You can use the search criteria that you create and store at the library level in multiple log file monitors simultaneously. You can also share search criteria by exporting it from or importing it to other machines. For details about importing and exporting search criteria, see Chapter 9, "Exporting and Importing in Fathom."

> Within your work environment, it is likely important for you to know when a database is unexpectedly down. Perhaps the effectiveness of your company's operations have suffered lately due to unplanned database down time. Obtaining information from the log file about these events could help you better research the issue.

> To help you assess what might be happening, you can set up a literal search for the words database down. Once you enable the search against the log file, Fathom checks the file for an occurrence of the phrase, based on your polling cycle, and reports on its findings.

> You must provide values for the Search Type and the Search Text fields on the Create Search Criterion page. The Search Type is a drop-down list. Depending on the type of expression you enter in the Search Type field, select either the literal search string or Perl 5 regular expression option. In the Search Text field, you enter the specific value for the type of expression you selected.

> Another example of a literal text string you might search for in a log file is abnormal shutdown. A search based on this value yields a match only if the exact expression abnormal shutdown is found in the file. In contrast, a Perl 5 regular expression search supports a variety of notations that you can use for pattern matching, potentially yielding broader search results.

> Note: The Search Text field does not impose any length limits on your entry. However, for practical reasons, you might want to limit the length. Also, keep in mind that the Search Text field is case sensitive.

> To create a search criterion:

> 1. Select Library from the menu bar and click Create Search Criteria. The Create Search Criterion Monitor page appears:

> 2. In the Criterion Properties section, enter a value in the Name field. The search name can be a maximum of 32 characters, and it must not contain spaces between words, or use special characters such as an asterisk (*), an ampersand (&), or a period.
> 3. Enter a description in the Description field.
> 4. In the Search Text field, enter the search string you want the log file resource monitor to look for in the log file. The entry must be consistent with the type of search you are performing.
> 5. In the Search Type field, select either Literal Search or Regular Expression. See the "Specifying search criteria" section for a detailed description of these search types.
> 6. Store this search criterion in a Search Criteria category by choosing either:
> - Use Existing Category — From Category, scroll through the list of Fathom predefined categories and select one. The list includes these categories: AppServer Broker, AppServer Server, Database, Miscellaneous, NameServer, WebSpeed Broker, and WebSpeed Server.
> - Use New Category — In the Category field, use the predefined misc category, or enter the name of a new category.
> 7. Click Save to save this search criterion.
> The search criterion is now available from the list frame. You can display it from the category to which you assigned it.

> 8. Repeat these steps for each additional criterion you want to create.

> ##### Using Perl 5 expressions to create search criteria

> Table 7–1 identifies some Perl 5 regular expressions you can use. Similarly, Table 7–2 suggests specific examples based on this notation.

> Table 7–1: Perl 5 regular expressions
> Perl 5 expression | Description
> --- | ---
> . | Matches exactly one character, regardless of what the character is.
> ? | The preceding item is optional and matched at most once (error if no preceding item).
> * | The preceding item will be matched zero or more times (error if no preceding item).
> + | The preceding item will be matched one or more times (error if no preceding item).
> ^ | Match at beginning of line.
> $ | Match at end of line.
> {n} | The preceding item is matched exactly `n` times (error if no preceding item).
> {n, } | The preceding item is matched `n` or more times (error if no preceding item).
> {,m} | The preceding item is optional and is matched at most `m` times (error if no preceding item).
> {n,m} | The preceding item is matched at least `n` times, but not more than `m` times (error if no preceding item).
> [abc] | Matches the characters `a` OR `b` OR `c`.
> [a-z] | Matches any character from a to z.
> [^abc] | Matches any character EXCEPT`a`, `b`, or `c`.
> \d | Matches exactly one digit.
> \D | Matches any character EXCEPT a digit.
> \w | Matches exactly one letter, number, or the underscore character(_).
> \W | Matches any one character EXCEPT a letter, number, or the underscore character.
> \s | Matches exactly one character of white space (for example, spaces, tabs, newlines, or any character that would not use ink if printed on a printer).
> \S | Matches any character that is NOT a white space.
> \ | Dereferences metacharacters (called "quoting").
> | | Separates two or more choices such as either|or behavior.

> Table 7–2 provides some examples based on the Perl 5 regular expressions identified in Table 7–1.

> Table 7–2: Examples using the Perl 5 regular expressions
> Example | Description
> --- | ---
> ^error | Matches the exact word error only when it appears at the beginning of a line.
> \(9239\)$ | Matches the exact entry (9239) only when it appears at the end of a line.
> da.*e | Matches the exact words date, daze, database, and dat tape. This Perl 5 regular expression, .*, is similar to the wild card * on UNIX.
> abc|abd|abe | Matches abc, abd, and abe.
> b.d | Matches bad, bud, and bid, but not bald.
> da.....e | Matches database and dat tape, but not date and daze.
> 3.14 | Matches 3.14, 3f14, and 3814.
> 3\.14 | Matches 3.14, but not 3f14 and 3814.
> ab?c | Matches ac and abc.
> ab*c | Matches ac, abc, abbc, abbbc, and so forth.
> ab+c | Matches abc, abbc, and so forth, but not ac.
> d\.*z | Matches dz, d.z, d..z, d...z, and so forth.
> d.\*z | Matches da*z, db*z, dc*z, and so forth.
> 1\.\d\d | Matches any three-digit floating point number from 1.00 to 1.99******.
> a\Dc | Matches abc, a&c, and aFc, but not a2c or a8c.
> a\wc | Matches abc, aGc, and a_c, but not a%c.
> a\Wc | Matches a%c, a?c, and a c, but not abc, aGc, or a_c.
> a\sc | Matches any three-character string starting with a and ending with c whose second character is a space, tab, or newline.
> a\Sc | Matches any three-character string starting with a and ending with c whose second character is not a space, tab, or newline.
> ab{3,5}c | Matches abbbc, abbbbc, abbbbbc, only.
> .{3,5} pentane | Matches cyclopentane, neopentane, and isopentane, but not n-pentane.
> a[bc]d | Matches abd and acd, only.
> a[a-z]c | Matches any three-character string starting with a and ending with c, and whose second character is any letter from a to z, inclusive.

> ##### Selecting search criteria to define a local rule

> Adding and defining a rule requires you to select search criteria and to associate severity and alert information with it.

> To add a rule to a log file monitor:

> 1. On the Edit Monitoring Plan page, click Add Rule. The Create Log File Rule Monitor page appears:

> 2. From Choose Criteria Category, select the category in which the search criteria you want to use is defined.
> 3. From Choose Search Criteria, display all currently defined search criteria for the category previously selected and select a search criteria.
> The search text automatically appears in the Criterion Search Text field, and a description automatically appears in the Search Criterion Description field.

> 4. From Severity, select the level of severity you want to set.
> 5. From On Alert Perform Action, select the action you want Fathom to perform when an alert is triggered.
> 6. Click Save. The Monitoring Plan page reappears and includes the new rule:

> 7. As necessary, repeat Step 1 through Step 6 to add more individual rules.
> Note the following points concerning individual rules that you add to a log file monitor resource:

> - Individual rules display in alphabetical order and appear in the list before rule sets.
> - Each rule appears with an associated resource status indicator.
> - You can click any rule to display summarized details about it.
> - You must explicitly create an individual rule to add it to the rule set; an individual rule is not directly available for use in any rule set.
> 8. Choose one:
> - If you want to add rule sets, see the "Associating rule sets with log file monitors" section for details.
> - If you are done adding rules, click Done. The Log File Monitor summary page appears, displaying any rules and rule sets selected for a log file monitor.

Copyright © 2004 Progress Software Corporation www.progress.com Voice: (781) 280-4000 Fax: (781) 280-4095