...
- On each execution, the monitor scans only new records and not the entire log.
- It is also possible to configure the alerts to include the entire result or selected information from the matched log events:
- Under the Advanced Section of the email alert you can attach data:
Append event to end of email body - matched log events will be included in the email body.
Attach matched events as a compressed Tab Delimited / CSV / XML file. - It is possible to add selected log fields to monitor alerts by placing the following place holders:
[SEARCH_QUERY] = By default, the search query used in the search monitor is presented in the alert's subject. Occasionally, the search query may be long so it is possible to include this placeholder in the email body which will be replaced upon execution with the query.
[COLUMN_NAME] = the name of the column which its content will be included
[MONITOR_ID] = the unique id of the monitor
[MONITOR_NAME] = the name of the monitor
[MONITOR_STATUS] = the monitor status : 1 = failure , 0 = success
[LOG_NAME] = the log name that the included event is originated from
[LOG_ID] = the log name that the included event is originated from
[HOST_NAME] = the host name that the included event is originated from
[APPS_ID] = the application(s) name(s) that the included event is originated from
[FOLDER_NAME] = the parent folder name that the included event is originated from
- Under the Advanced Section of the email alert you can attach data:
...