Content Parsing Monitors

This section describes all the Monitors available to parse the content generated by the File, Folder, Command Line, Web Request (HTTP), Database Query (SQL), WMI Query, WBEM Query, SNMP Polling, PSL Script, and Nagios Plugin Monitors.

Text Pre-Processing

The Text Pre-Processing Monitor allows you to transform a multi-line, XML, JSON, or HTML content into a simpler format (single line, CSV, flat map, etc.) that can be parsed with the String Search, Numeric Value Extraction, Value Map, and Dynamic Object Monitors. To achieve this, Monitoring Studio X only needs to know the lines to be pre-processed and the transformation to be performed.

Once the Text Pre-Processing Monitor is properly configured, Monitoring Studio X will pre-process the content and display the new format in the Results parameter.

Refer to the table below to know how to configure the Text Pre-Processing Monitor.

Property Description
Pre-Process the Results From (Optional) If you need to filter the Monitor output to remove unwanted text before parsing it, select which lines of the result should be scanned:
  • All Lines (default): All lines of the text will be pre-processed. There is no need to provide further information.
  • Line Numbers: Indicate the specific line numbers to be pre-processed. Expected formats:
    • x, y: line x and line y
    • x-y: all lines from x to y inclusive
    • x: only line x
    • x-: all lines from x to the end of the file inclusive.

Process Only Lines That (Optional) Enter the string or regular expression to look for, and specify whether or not it should be contained in the selected lines.
Display Name Name to identify the Text Pre-Processing instance in TrueSight Operations Management.
Internal ID ID to be used to store the Text Pre-Processing Monitor configuration in the PATROL Agent configuration. This Internal ID is automatically generated based on the Display Name provided but can be edited if needed.
Transformation Click Add Transformation and select the transformation to be performed:
  • Convert Multi-Line Records Into A Single Line: Enter the regular expression or string that marks the beginning and/or the end of the record. If the regular expression can match with any part of the first and/or the last line of each paragraph, include the first and/or the last line in the result. Use ^$ to match an empty line.
  • Convert XML to CSV (Comma-Separated Values): Enter the XML tag that defines the record, sub-objects, and properties, and the character to be used as a separator.
  • Convert JSON to CSV (Comma-Separated Values):
    • Enter the JSON entry key that defines the record
    • List the properties defined for the provided JSON entry. Separate each property with a semi-colon (;).
    • Specify which separator to use to isolate each property in the output file, such as dot (.), dash (-), double semi-colon (;), comma (,), pipe, plus sign (+), etc.
  • Convert JSON to Flat Map (Property=Value Pairs). There is no need to provide further information.
  • Extract Text From HTML. There is no need to provide further information.
  • Pre-process Through an External Command: Select this option to process the content through a custom script or utility. You will then have to:
    • Enter the command to be executed on the localhost where your PATROL Agent is installed. The %{INPUTFILE} and %{OUTPUTFILE} macros must be used in the command to pass the selected content to the command and to read the processed output respectively.
    • Enter the regular expression to be found in the output to consider the command successful.


You can now perform string searches, extract numeric values, map values or build dynamic objects from the Results parameter output.

For more information about the parameters available, refer to Studio Text Transform.

The String Search Monitor allows you to search for a specific string in the information sources that you previously configured (flat or log files, output of a Web request or a database query, OID content, etc). A typical usage is to search for the Failure or Error string in a log file to be informed as soon as a problem occurs and to have Monitoring Studio X acknowledge the alert when the Success string is found.

To find string(s), you need to indicate to Monitoring Studio X:

  • the string(s) to be searched
  • where the string(s) should be found (anywhere in the line, at character offset, or in a specific column number)
  • how alerts should be acknowledged (after a certain time or when another string is found) and the operation to be performed.
If the file to be parsed is a multi-line, XML, JSON, or HTML content, you may have to first pre-process its content.

Once the String Search Monitor is properly configured, Monitoring Studio X will either:

  • search for the string(s) in the new lines since the last polling and provide the last lines found, the number of lines matching the string search, and the number of lines matching the string search per minute. This is the operation mode for log files and never ending command lines.
  • or search for the string(s) in the entire source (the whole file, the whole standard output, the whole HTTP response, the whole dataset, etc.) and provide the number of lines matching the string search. This is the operation mode for flat sources or any other source.

Depending on your configuration, an Alert message will either be triggered when a matching line is found or when the threshold is breached.

Refer to the table below to know how to configure the String Search Monitor.

Property Description
Search for Lines that Contain / Do Not Contain Enter the string (regular expression) to look for and select whether the string should be contained or not in the line (Example: Contain Failure or Do Not Contain Success). You will then have to indicate where the string should be searched. Possible values are:
  • Anywhere In the Line (default).
  • At Character Offset: Enter the character number (Example: 7 to search for a string that starts from the seventh character in the line).
  • In Column Number: Enter the column number where the string should be found.

Display Name Name to identify the String Search instance in TrueSight Operations Management.
Internal ID ID to be used to store the String Search Monitor configuration in the PATROL Agent configuration. This Internal ID is automatically generated based on the Display Name provided but can be edited if needed.
Search Options 1. (Optional) Specify a second string and indicate whether both strings should be found (AND), or if only one of the two strings is sufficient (OR).
2. (In Column Numbers) Select the column separators.
3. Indicate whether the search is case sensitive.
4. Indicate whether Monitoring Studio X will ignore blank lines. This option is particularly useful when searching for lines that do not contain a specific string, as blank lines would match this search criteria.
5. (Log File Monitoring) Indicate how the Matching Line Count parameter will report matches. Possible values are:
  • Since Last Acknowledge (Incremental): Select this option to count the lines matching the String Search since the last time the Matching Line Count parameter was reset or since the PATROL Agent started.
  • In the Current Collect Only: Select this option to count the lines matching the String Search during the current collect.




Auto-Acknowledge Options
(Log File or Never Ending Command Line Monitoring Only)
1. First, specify how alerts should be acknowledged. You can either:
  • Acknowledge Alert On Timeout: In this case, specify the time in minutes after which the alert will be automatically acknowledged (Default: 120 minutes).
  • Acknowledge Alert On Another String Search: In this case, specify the string that will automatically acknowledge the alert (Example: The alert will be acknowledged when the string Success is found in the log file).

2. Specify the action you wish Monitoring Studio X to perform when acknowledging an alert. Select:
  • Reset “Matching Line Count” to have Monitoring Studio X automatically reset the counter of the Matching Line Count parameter to zero.
  • Decrease the “Matching Line Count” by One to have Monitoring Studio X automatically decrease the Matching Line Count parameter by one.

Trigger Alert Message for Every Match Enable this option to trigger an Alert Message for every matching line, and not just when breaching the threshold.

For more information about the parameters available and the thresholds set by default, refer to Studio String Search.

Numeric Value Extraction

The Numeric Value Extraction Monitor allows you to extract a number from a text input (the output of a command, a Web page, the result of a SQL query, or WBEM query, etc.). You can for example extract from a text input any numeric value that will inform you about the queue length, processing time, utilization percentage, etc. of a specific technology.

To extract numeric values, you need to indicate to Monitoring Studio X:

  • the information source
  • the location of the numeric value within the searched lines using a regular expression
  • the position of the numeric value in the search lines. The position can be for example before or after a specific string, in a specific column, etc.
  • the value to be considered if several values are found (the first, the last, the highest, the lowest, etc.).
If the file to be parsed is a multi-line, XML, JSON, or HTML content, you may have to first pre-process its content.

Once the Numeric Value Extraction Monitor is properly configured, Monitoring Studio X will either:

  • search the numeric values in the new lines since the last polling. This is the operation mode for the log files and never-ending command lines.
  • or search in the entire source (the whole file, the whole standard output, the whole HTTP response, the whole data-set). This is the operation mode for flat files, command lines, Web requests, and database queries.

Monitoring Studio X will then indicate in TrueSight whether the value was found through the Present parameter and if so, what is the actual value.

Refer to the table below to know how to configure the Numeric Value Extraction Monitor.

Property Description
Numeric Value Extraction Settings 1. Select the option corresponding to the lines that will be searched:
  • All Lines (default): All lines of the text will be scanned for the Numeric value search. There is no need to provide further information.
  • Line Numbers: Indicate the specific line numbers to be scanned and whether blank lines should be ignored in the line-count. Expected formats:
    • x, y: line x and line y
    • x-y: all lines from x to y inclusive
    • x: only line x
    • x-: all lines from x to the end of the file inclusive.
  • Lines Matching Regular Expression: Only the lines matching the regular expression will be searched.


2. Indicate the position of the numeric value in the searched lines. Possible values are:
  • After the String/Before the String: Enter the corresponding string.
  • At Character Offset: Enter the character number (Example: 7 to search for a numeric value that starts from the seventh character in the line).
  • In Column Number: Enter the column number where the numeric value should be found and select the column separators to be considered.


Display Name Name to identify the Numeric Value Extraction instance in TrueSight Operations Management.
Internal ID ID to be used to store the Numeric Value Extraction Monitor configuration in the PATROL Agent configuration. This Internal ID is automatically generated based on the Display Name provided but can be edited if needed.
Numeric Value Options Indicate:
  • whether the Monitored Value is a raw value or a delta, the difference between current and last collected values. If you select one of the Delta options, you will have to indicate whether negative values should be discarded.
  • the value to be considered if several values are found (the first, the last, the highest, the lowest, etc.).
  • the expected format.
  • whether extracted values can be negative.
  • whether extracted values are automatically converted.
  • whether a rescaling should be performed.
  • whether execution errors should be reported in the Collection Error Count parameter of the template.

For more information about the parameters available and the thresholds set by default, refer to Studio Number Extract.

Value Map

The Value Map Monitor allows you to extract values from result outputs generated by other Monitors and map up to 25 of these values to user-defined statuses. To achieve this, you need to indicate to Monitoring Studio X:

  • the source from which the values will be extracted
  • where the values can be found
  • how these values should be mapped to user-defined statuses.

When the Value Map Monitor is properly configured, the Status is displayed in TrueSight. Thresholds can then be set to have Monitoring Studio X trigger alerts in TrueSight.

Refer to the table below to know how to configure the Value Map Monitor.

Property Description
Interpret Values in 1. Select the option corresponding to the lines that will be searched:
  • All Lines (default): All lines of the text will be scanned. There is no need to provide further information.
  • Line Numbers: Indicate the specific line numbers to be scanned and whether blank lines should be ignored in the line-count. Expected formats:
    • x, y: line x and line y
    • x-y: all lines from x to y inclusive
    • x: only line x
    • x-: all lines from x to the end of the file inclusive
  • Lines Matching Regular Expression: Only the lines matching the regular expression will be searched.


2. Indicate the position of the value in the searched lines. Possible values are:
  • After the String/Before the String: Enter the corresponding string.
  • At Character Offset: Enter the character number (Example: 7 to search for a value that starts from the seventh character in the line).
  • In Column Number: Enter the column number where the value should be found and select the column separators to be considered.


Status Map Map each possible extracted value to a Status and an associated description (optional). Note that you can specify regular expressions to match several similar values. You can also specify an empty value, which will be matched if the extracted value is an empty string.
Display Name Name to identify the Value Map instance in TrueSight Operations Management.
Internal ID ID to be used to store the Value Map Monitor configuration in the PATROL Agent configuration. This Internal ID is automatically generated based on the Display Name provided but can be edited if needed.
If No Value is Found (Optional) Action to be performed by Monitoring Studio X if no value is found. By default, an error is reported in the Collection Error Count parameter of the template.
When Several Lines Contain a Value (Optional) Action to be performed by Monitoring Studio X when several lines contain a value. By default, Monitoring Studio X keeps the most critical value.

For more information about the parameters available and the thresholds set by default, refer to Studio Value Map.

Keywords:
studio km patrol develop web