We had a similar issue too.    We did open a case with Microsoft and they replied it was still an issue.

 

The file we were trying to monitor would be renamed or deleted once every 24 hours by a task the customer had set up.   The workaround we came up with was to:

 

1)  add a wild card  (?)  for the last character of the log name.

 

2)  as the customer's process completed that either deleted or renamed the previous file,  a step was added to restart the OpsMgr Health Service.

 

With the restart of the service, the newly created log file was discovered and monitored.

 

From: admin@lists.myITforum.com [mailto:admin@lists.myITforum.com] On Behalf Of Kevin Holman
Sent: Thursday, September 24, 2009 9:39 AM
To: msmom@lists.myitforum.com
Subject: [msmom] RE: Generic Text Log Alerting...

Brad – if I recall correctly – the rollover is something we had a problem with…. I believe we had problems monitoring SMS/SCCM log files at one time for this same reason at RTM.

 

It is very possible that our log file monitor has trouble with the rollover process, because of the way we try to lock the file, and keep a watermark.

 

You will probably have to open a case for this specific issue to find out exactly what’s up with it.

 

 

 

I have been asked to monitor a plain text log for a specific piece of text and alert on it. I set up a rule that correctly finds that piece of text and opens an alert, but after a period of time it stops working.

The log file I am monitoring grows to 5MB, dumps to a time stamped log file, and then starts over. I think this roll over process is what’s causing my rule to stop working.

Has anyone else run into this problem or have any suggestions on how to deal with it?

Brad Mueller

Central Technology Services

2100 Stewart Drive

Jefferson City, MO 65109

(573) 634-5600 ext. 6423

brad_mueller@centraltechnology.net

**************************************************************************************************Note: The information contained in this message may be privileged and confidential and protected from disclosure.  If the reader of this message is not the intended  recipient, or an employee or agent responsible for delivering this message to  the intended recipient, you are hereby notified that any dissemination,   distribution or copying of this communication is strictly prohibited. If you  have received this communication in error, please notify us immediately by  replying to the message and deleting it from your computer. **************************************************************************************************

==============
Missed an email? Check out the list archive:
http://myitforum.com/cs2/blogs/momlist/

==============
Missed an email? Check out the list archive:
http://myitforum.com/cs2/blogs/momlist/

  -----Message Disclaimer----- This e-mail message is intended only for the use of the individual orentity to which it is addressed, and may contain information that isprivileged, confidential and exempt from disclosure under applicable law.If you are not the intended recipient, any dissemination, distribution orcopying of this communication is strictly prohibited. If you havereceived this communication in error, please notify us immediately byreply email to Connect@principal.com and delete or destroy all copies ofthe original message and attachments thereto. Email sent to or from thePrincipal Financial Group or any of its member companies may be retainedas required by law or regulation. Nothing in this message is intended to constitute an Electronic signaturefor purposes of the Uniform Electronic Transactions Act (UETA) or theElectronic Signatures in Global and National Commerce Act ("E-Sign")unless a specific statement to the contrary is included in this message. While this communication may be used to promote or market a transactionor an idea that is discussed in the publication, it is intended to providegeneral information about the subject matter covered and is provided withthe understanding that The Principal is not rendering legal, accounting,or tax advice. It is not a marketed opinion and may not be used to avoidpenalties under the Internal Revenue Code. You should consult withappropriate counsel or other advisors on all matters pertaining to legal,tax, or accounting obligations and requirements.

==============
Missed an email? Check out the list archive:
http://myitforum.com/cs2/blogs/momlist/