Text log file Monitor

Question

Hi Team,
i have a task to create a log file example SCOM.log, the log has all text entries and the pattern is like below  
"[0014 20140724 094527069 SCOM E] ProcessDeposits(), DMGATEWAY internal error in plugin: An exception occurred while processing terminal transaction with HostTransactionID: '4143', tracking fact Id: '3' in the Deposit Gateway Processor task 7. The transaction
will be NOT be re-queued. // "
we need to monitor anything which has "DMGATEWAY internal error in plugin:" string.
sometimes we have greater then 10 entries with in few seconds.
once the log file reaches 10MB all the entries are moved to an archive log file that means the present SCOM.log file is empty and start from line one again.
any suggestions \ solution will be a great help and also let me know if you need any further information
-Vrkumar01
RajKumar

Answer 1

Hi Raj,
Have a read through this post it highlights issues with log monitoring:  http://social.technet.microsoft.com/Forums/systemcenter/en-US/827464fd-ff06-495d-8ac6-4a6e337314d3/bug-in-scom-log-file-monitor?forum=operationsmanagergeneral
Have a look at creating a script monitor to monitor the log file:
http://www.opsmanager.se/2012/11/06/text-log-monitoring-part-1/
http://www.opsmanager.se/2012/12/17/text-log-monitoring-in-operations-manager-part-2/
The issue you are experiencing is a limitation of scom which is documented here:
 http://support.microsoft.com/kb/2691973/en-us
Snippet  from KB:
Additional Information
When monitoring a log file, Operations Manager remembers the last line read within the file (a 'high water mark'). It will not re-read data before
this point unless the file is deleted and recreated, or renamed and recreated, which will reset the high water mark.
If a logfile is deleted and recreated with the same name within the same minute, the high water mark will not be reset, and log entries will
be ignored until the high water mark is exceeded. 
An implication of this is that log files that are cleared periodically without being renamed and recreated, or deleted and recreated, will not have entries in them processed until the high water mark from before the log is cleared is exceeded.
Operations Manager cannot monitor 'circular log files' (i.e. log files that get to a certain size or line count, then start writing the newest entries at the beginning of the log) for the same reason. The log file must be deleted or renamed and then recreated,
or the application configured to write to a new log once the current log is filled.
Cheers,
Martin
Blog:
http://sustaslog.wordpress.com 
LinkedIn:
Note: Posts are provided “AS IS” without warranty of any kind, either expressed or implied, including but not limited to the implied warranties of merchantability and/or fitness for a particular purpose.