MonitorWare Knowledge Base

Hello,

I'm attempting to deploy a limited number of MWAgent servers by geographic region, each responsible for reading logs from several servers in that geographical region (accessing the logs via \\\\unc\\path). This part works as expected.

However, when forwarding to syslog the source/host always appears to be the MWAgent server, rather than the actual source of the message. Is it possible to manipulate the messages so the actual source is sent to the syslog server (possibly by extracting the hostname from the UNC path of the source service/log)?

Thank you,

-Brian

Dear Brian,

there is a property called %generatedfilename% which contains the full filename and path of the current processed logfile. You can use this property to determine from where the logfile was read from.

However it also possible to overwrite the %source% property by using a Set Property Action. Use this kind of Property value:

Code: Select all

%generatedfilename:/\\\\/$:/\\/%

It will start searching wit \\ and end searching with \. The content between will be set to the desired property (source in our case). This will work for UNC pathes like this:
\\server\c$\temp\file.log

I also attached XML Code for a Action. Copy this into your clipboard, you can paste it as Action within the MWAgent Client.

Code: Select all

<Actions><Action name="Overwrite Source Property" type="1012" Comments="" bActionEnabled="1" nPropertyType="-1" szPropertyValue="%generatedfilename:/\\\\/$:/\\/%" szPropertyType="source"/></Actions>

Thank you! This is exactly what I was trying to do.

I had some license issues which made the Set Property Action unavailable, but once I got that sorted out.