Overview

The File Event Monitor is designed to look at individual files, check their dates, sizes, and contents. It's perfect for scanning log files for specific text and getting alerts about modified files.

Use Cases

• Checking log files for error messages
• Detecting log files that are quickly growing in size
• Looking for specific words in text files

Monitoring Options

This event monitor provides the following options:

File Path

Enter a UNC path to the file that you want to monitor. Instead of entering an actual device name, use [devicename] as in the following example: \\[devicename]\c$\folder\file.txt When the event monitor runs, it will substitute [devicename] for each of the devices selected in the Network Devices section.

Alert with [Info/Warning/Error/Critical] if the device cannot be contacted

Use this option to alert if the event monitor cannot connect to the network device.

Alert with [Info/Warning/Error/Critical] if the file is [missing/present]

Use this option to alert if the event monitor was able to connect to the network device, but the file was missing or present. You might use the option to alert when a file is missing if you have a critical configuration file that applications or services depend on. The option to alert if the file is present can be used for cases where applications or services create an error file when an unexpected condition is detected.

Alert with [Info/Warning/Error/Critical] if the file size has [increase/decrease/changed/remained the same] since the last run

Use this option to alert based on changes in the file's size.

Alert with [Info/Warning/Error/Critical] if the file's last modified date has [changed/remained the same] since the last run

Use this option to alert based on the file's last modified date.

Alert if the file is larger than a specified size

With this option, you can get alerts if the file's size exceeds the thresholds that you specify.

Alert if the file is smaller than a specified size

This option can be used to alert if the file's size is smaller than the specific thresholds that you choose.

Check the contents of the file

Enable this option to access further checks that will look at the content of the file.

Alert with [Info/Warning/Error/Critical] if the file contains the text [text string]

Use this option to get alerts when specified text is found in the file.

When the text is found, show the line the text is on

If this option is enabled and a match is found, the line that the match was found on will be included in all alerts and notifications.

When the text is found, show the previous [#] lines

Use this option to also include some of the lines that precede the one where the match was found.

When the text is found, show the following [#] lines

Use this option to also include some of the lines that follow the one where the match was found.

Use a regular expression when matching text

With this option enabled, the search text will be interpreted as a regular expression.

Do not alert if the same line contains [text string]

With this option enabled and a match is found, the match will be ignored if any of the specified comma-separated text is found on the same line.

Alert with [Info/Warning/Error/Critical] if the file does not contain the text [text string]

This option is the opposite of the previous one. It will alert you if the specified text is not found in the file.

Use a regular expression when matching text

With this option enabled, the search text will be interpreted as a regular expression.

Only check for text that is new since the last check

By default, the event monitor will scan the entire file for the text you specify. With this option enabled, it will only check new text that has been appended to the file since the last check.

Show the first [#] lines of the file in all notifications

With this option enabled, the event monitor will show the first lines of the file in all alerts and notifications.

Show the last [#] lines of the file in all notifications

With this option enabled, the event monitor will show the last lines of the file in all alerts and notifications.

Show the first [#] lines of new content from the file in all notifications

With this option enabled, the event monitor will show a portion of the new content that was added to the file since the last run.

Enable date/time tokens in the file name

With this option enabled, the event monitor will use the time the event monitor runs to replace time tokens in the given file name.

Which would then use the current year, month and day to change the file name to: \\[devicename]\c$\folder\file-1977-05-06.ext

Authentication and Security

The account used for authentication must have permission to access the file and all its contents.

Protocols

Data Points

This event monitor generates the following data points:

Data Point	Description
File Size	The size of the file.

Sample Output

Tutorial

To view the tutorial for this event monitor, click here.