Log Analysis - Changing the Alert level can split the report

All questions related to installations, configurations and maintenance of Advanced Host Monitor (including additional tools such as RMA for Windows, RMA Manager, Web Servie, RCC).
Post Reply
terje
Posts: 88
Joined: Mon Jul 25, 2005 7:45 pm
Location: Sydney

Log Analysis - Changing the Alert level can split the report

Post by terje »

This may not be a bug. It may be a wish. However to me it looks like a bug.

If I have a test that checks free space on a drive it might log as follows:-
TEST NAME: Server123 Drive D
TEST METHOD: check UNC (20%)
If I then change the alert threshold to a different amount it might subsequently log like this:-
TEST NAME: Server123 Drive D
TEST METHOD: check UNC (10%)
When I run a Log Analysis report based on the log files I then get two separate graphs for the test as if they represent two different tests entirely. I get a graph for the period when my alert level was at 20% and a separate report for the period during which my alert level was at 10%.

The problem does not seem to occur for some other test types. For instance if I do a "CPU Usage" test then it would log as follows:-
TEST NAME: Server123 Processor
TEST METHOD: CPU usage
The test method for "CPU usage" does not include any threshold levels in the logged test method, so changing these alert levels does not confuse the log analyser.

Three questions come to mind:-
Q1. Is there a reason that alert levels are included in the log files for some test types (eg UNC) but not other test types (eg CPU)?

Q2. Is there a reason that the log analyser treats different alert levels as if they were different tests? Shouldn't the name of the test be the only distinguishing feature?

Q3. Is this problem a bug or a feature?
Okay I admit that Q2 is really two questions.

We tune alert levels quite often. However we don't want to fragment the reports every time an alert level is tuned.

Regards,
Terje.

P.S. In the interum I have done a search and replace in the log files to trick the log analyser into thinking all the tests were done at the same alert level.
KS-Soft
Posts: 13012
Joined: Wed Apr 03, 2002 6:00 pm
Location: USA
Contact:

Post by KS-Soft »

Its not a bug but I agree its not very nice behaviour. Problem is - Log Analyzer works with log files that do not contain information about folder structure, unique test ids and so on. Many people have test items with the same name in different folders but Log Analyzer knows nothing about folders so it uses test method field as additional identification.

We plan to make ODBC log as default logging method and maintain additional table with information about folder structure. After that we can completely redesign Log Analyzer.
However we will need to support old log files in case somebody do not want to use ODBC :-?

Regards
Alex
terje
Posts: 88
Joined: Mon Jul 25, 2005 7:45 pm
Location: Sydney

Post by terje »

We move tests to different folders or sometimes rename folders and would not want the log to treat these as a different test.

For each major folder we are typically logging to a specific private log and doing scripted reports based on these private logs.

Rather than logging the folder structure I think a better approach would be to give each test a unique system generated identifier seperate to the test name. This unique identifier could be logged and used for analysis purposes.
KS-Soft
Posts: 13012
Joined: Wed Apr 03, 2002 6:00 pm
Location: USA
Contact:

Post by KS-Soft »

We move tests to different folders or sometimes rename folders and would not want the log to treat these as a different test.
Don't see any problem here. As I said Log Analyzer knows nothing about folders
Rather than logging the folder structure I think a better approach would be to give each test a unique system generated identifier seperate to the test name.
Each test has unique ID. Folder structure does not replace such ID, it can provide additional information. E.g. you will be able to generate charts for all tests within specific folder. Is that bad?
This unique identifier could be logged and used for analysis purposes.
Of course. That's what I was trying to say

Regards
Alex
terje
Posts: 88
Joined: Mon Jul 25, 2005 7:45 pm
Location: Sydney

Post by terje »

Okay.

Sounds good.
Post Reply