This was originally posted on the SCCM and OpsMgr Arabic blog. If you ever have the need to monitor a text or log file for new entries then this should do the trick.
You may wish to monitor any new entry in a log/text file and want to get an alert generated no matter what the entry is. Usually we want an alert to be generated once a word or expression is logged, but in this post I will be shedding lights on monitoring a log file and generate an alert when any new entry is logged in the log/text file.
A new Entry was detect in the c:\log\bader.log
Logfile Directory : $Data/EventData/DataItem/LogFileDirectory$ Logfile name: $Data/EventData/DataItem/LogFileName$ String: $Data/EventData/DataItem/Params/Param$
You can notice that the alert description includes the new entry which was logged in the log file.
i'm not getting the description... im' getting 3 "alert parameter replacement failure" alerts, and my actual alert from the event log has
Logfile Directory :
How to get more lines than one? Let say 10 at least. Thanks in advance.
Does your alert still works if you roll the log file daily/hourly etc (recreate a new log file every night etc) and add a new line? From what I know about the SCOM logfile monitor it keeps track of every line and where is was when the alert was generated (e.g. alerted on line # 100) and the log file rolled over, SCOM logfile monitor doesn't know that it needs to start from line # one in the new logfile as it will be looking for line # 101). let me know if you got this to work and how you did it.
I configured the steps as above but i received an error in server’s event log with event id:31705, “error Opening the log file directory”
Error opening log file directory
“D:Program Files (x86)Quest SoftwareQCVDSR6.0.3confslogs”
Details: The filename, directory name, or volume label syntax is incorrect.
Log file name is “operation_dumper.log.yyyymmdd…….every day the new file will be created with the data,month and year.
i configured pattern as operation_dumper.log.????????