Return
-
Title
"Maximum matches obtained..." error message reported after setting up LogMonitor agent to monitor a large file. -
Description
After setting up a LogMonitor agent to monitor a large file the Record data is not being collected but "New Records Found" and "File Size Increase" graphs are populated.Messages like the following are reported in log of newly installed LogMonitor agent.ECHO <HostAgents/5.7.1/DellFileLogMonitorAgent/SYSLOG-agent> ERROR [Quartz[0]-1655] com.dell.foglight.infrastructure.actions.logmonitor.AbstractLogScanReceiver - An error was detected while scanning remote file(s): Maximum matches obtained during scan operation so all records may not have been processed [Host:hostname]ECHO <HostAgents/5.7.1/DellFileLogMonitorAgent/SYSLOG-agent> VERBOSE [LogMonitorTopologyEarlySubmitter[5]-0] com.dell.foglight.infrastructure.actions.logmonitor.file.FileLogTopologyCreationAction - Discarding 150 record(s) in [hostname]/var/log/syslog timestamped at Mon Jan 19 03:34:22 PST 2015 or older, because they are too old and will be rejected anyway. -
Cause
The LogMonitor is working its way through the older records. Eventually the LogMonitor agent will work its way to the current log records and then Record data will be collected. -
Resolution
To help the LogMonitor agent get to the current records faster execute one or both of the following workarounds:WORKAROUND 1:Increase the Maximum Match count to 500. The Maximum Match count is found under the File Formats list in the properties of the LogMonitor agent.WORKAROUND 2:Make the record matching pattern more specific, if possible. If there are many records within the file that are being matched, and not all of the collected records are relevant, then the record pattern should be made more specific. Having a more specific regex (regular expression) match pattern will cause a smaller number of matches to records, and the file will be scanned faster.