SASR:host:metric_alert:LogFileMonitoring:log_file_match_count

Asset ID:	1-72-1953929.1
Update Date:	2016-11-10
Keywords:

Solution Type Problem Resolution Sure

Solution 1953929.1 : SASR:host:metric_alert:LogFileMonitoring:log_file_match_count - This Is An Automated Host Error On

Applies to:

Exadata X4-2 Half Rack - Version All Versions and later
Information in this document applies to any platform.

Symptoms

Hostname: dbh1dbadm02
Product Type: EM ASR PRODUCT
Summary:SASR:host:metric_alert:LogFileMonitoring:log_file_match_count - This is an automated host error on an Exadata System

Message Payload Data:
http://xml.apache.org/xalan/java http://xml.apache.org/xslt
IssueType = EVENT_METRIC_ALERT
TargetType = Host
TargetName = mydbadm02.mycompany.com
TargetVersion = 5.10.0.0.0
CCRTargetGUID = 89EAD9A28D29590FA8A244FFFBD0A912
EMTargetGUID = 5029DF30F3008A368A4A6664E0F5EF5F
HostName = mydbadm02.mycompany.com
HostSerialNo = 1234abcd5678
HWArchitecture = GenuineIntel x86_64
OS = Oracle Linux Server release 5.10
PlatformID = 226
PlatformVersionID = 8049
IncidentID = 5680
IncidentGUID = 08ADDA61E14066C5E053C2166880C9FD
IncidentCategories = Error
IncidentSummary = Scanned /var/log/messages from line 1 to 29682. Found 10 occurences of the pattern [panic] with ignore pattern [sendmail].. 10 crossed warning (0) or critical (1) threshold.
IncidentCreatedTime = 2014-11-25T05:10:32.000+00:00
EventName = LogFileMonitoring:log_file_match_count
EventClass = metric_alert
EventExpression = host:metric_alert:LogFileMonitoring:log_file_match_count
eventMessage = Scanned /var/log/messages from line 1 to 29682. Found 10 occurences of the pattern [panic] with ignore pattern [sendmail].. 10 crossed warning (0) or

Cause

The parser for the log file /var/log/messages is not as discriminating as it should be.

Solution

If and only if:

a) All the messages are to do with 'panic'

b) All those messages a lines like %panic=% from the grub boot command line.

c) The issues regarding the reboots are fixed (e.g. preventative maintenance ... etc)

Then you can ask the customer to run this command.

/usr/sbin/logrotate --force /etc/logrotate.conf

That should force a new /var/log/messages file which will contain only this line (at first)

syslogd 1.4.1: restart.

If no further messages are recieved for this alert then you can consider the issue resolved.

Attachments

This solution has no attachment