-
Title
Why is the DellFileLogMonitor agent referring to /tmp when 'Directory=/var/log' -
Description
The following is populating within the DellFileLogMonitorAgent agent log file:
YYYY-MM-DD HH:MM:SS.SSS ECHO <HostAgents/5.7.0/DellFileLogMonitorAgent/LogMon_Linux-agent> WARN [Quartz[0]-1] com.dell.foglight.infrastructure.actions.logmonitor.file.FileLogScanAction - Could not execute data collection commands for File Log Scan Action [Host=host1, HostType=UNIX, Directory=/var/log, Filename=messages]. It will be skipped in this collection period.
com.quest.glue.api.services.NonZeroExitCodeException: Process "/tmp/33-fglam-LogMon_Linux--1234-logmonitor" "-T" "FILE" "-m" "200" "-C" "120" "-d" "base64:L3Zhci9sb2c=" "-f" "base64:bWVzc2FnZXM=" "-s" "1024" "-n" "ANY" "-R" "NEW" "-p" "base64:W0NjXVtScl1bSWldW1R0XVtJaV1bQ2NdW0FhXVtMbF0=" "-p" "base64:W0ZmXVtBYV1bSWldW0xsXQ==" "-p" "base64:W0ZmXVtBYV1bVHRdW0FhXVtMbF0=" "-p" "base64:W0hoXVtBYV1bTGxdW1R0XQ==" "-p" "base64:W1BwXVtBYV1bTm5dW0lpXVtDY10=" "-p" "base64:W1d3XVtBYV1bUnJdW05uXVtJaV1bTm5dW0dnXQ==" exited with code 126
Why is the above referring to /tmp/, for example, "/tmp/33-fglam-LogMon_Linux--1234-logmonitor"?
-
Resolution
The DellFileLogMonitor agent uses an executable to monitor the log files. This executable is first copied onto the remote system into the /tmp directory for UNIX, and then it is executed from that location. The directory to monitor, /var/log in this case, is then passed into the log monitor executable as a parameter.