Users of BSM Connector 9.2x might have the need to monitor some logfiles in some of their critical servers. This can be achieved with "Event > Log File" policies.
However there might be some concerns about these monitored logfiles that may grow too much and fill the file system where they are located. For this reason, a rollover mechanism like the following one is widely used among customers:
where the main logfile myfile.log gets a new extension as soon as it reaches a particular size.
What it is unclear is how to manage this situation with "Event > Log File" policies because it is not clear if the pointer of the policy to the file is lost when the logfile rolls between two intervals because this would lead to events not sent from the BSMC to the target server, i.e. a BSM/OMi.
Customers who come from the classic OM world were used to work with the opcle process of the classic OA (Operations Agent) which offers the following method to work with dynamic logfiles like our customer's ones (source: https://softwaresupport.hp.com/group/softwaresupport/search-result/-/facetsearch/document/KM822367):
------- snip --------
A) The latest entries added to the old logfile will be processed and the new logfile (same name, different i-node) will be read after 20 intervals (due to OPC_LE_CHECK_INODE variable default value) and all the info from the old log file would be processed:
- do not enable the check "Close after read"
- keep the default value FALSE for variable OPC_LE_CALC_HASH in the Agent configuration
------- snip --------
where OPC_LE_CALC_HASH has this description:
If the value of OPC_LE_CALC_HASH is TRUE, opcle detects the file is appended or overwritten by calculating hash of last line and verifying
some random check points.If opcle detects the file is overwritten, then it reads the file from beginning.
But, now with the BSMC, the logfile monitoring is not carried out by opcle anymore; it is opcgeni which is responsible for this scenario.
The Bonline help section related to the “Event > Logfile” policies doesn't show anything related to this and the “Event > Logfile” policy type doesn't offer anymore the possibility to enable/disable the “Close file after Reading” option as it currently happens in the OMW/OMU/OML policy editors for Logfile Encapsulator policies.
However, this option is present the “Event > XML” policy type. Notice also that this policy type offers the possibility to work with wildcards ( <*> ) to match different files with similar names.