How to detect a specific event pattern in an Agent log file using the LogFilter agent. (4317100)

You may need to monitor agent log files for specific messages, such as connection failures or status changes.
For example:

om.sma.mongodb.agent.ContextManager - Unable to connect to

or

Remote state of agent <agent_name> changed from COLLECTING_DATA to NOT_COLLECTING_DATA

Agents may log key operational messages when they lose connectivity or change their data collection state. These events may indicate environmental issues, authentication problems, or configuration errors.

1). Use the LogFilter Agent
Configure the LogFilter agent to monitor the appropriate log file (for example, a MongoDB Agent log or FglAM log).

• Point the LogFilter to the target log directory.

• Specify the pattern to detect, e.g.:
  om.sma.mongodb.agent.ContextManager - Unable to connect to

• Set the LogFilter agent to trigger an alarm or notification when the pattern appears.
  (Refer to the attached example configuration, which demonstrates how to set up the LogFilter agent for detecting “NOT_COLLECTING_DATA” events. The same procedure applies for any log pattern. Users must be logged in to download the attachment)

2). Enable an Optional Rule (if applicable)
For data collection monitoring, you can also enable the Idle Agents rule to periodically check for inactive or idle agents.