SAP Syslog Monitor

Overview

Monitoring of Syslog entries. Shows how many syslog entries have occurred per application instance

Executable	SAP_Syslog_Monitor.exe
Connection method	HTTP
Ports	5$$13 (http) 5$$14 (https) ($$ = instance number)

Default parameters

Parameter name	Possible values	Default	Description
Host	<ip> | <hostname> | <fqdn>	empty	Hostname or IP of the target system. If you use a virtual hostname on your SAP servers, please use also the virtual host to connect.
SAPInstance	number (2) | 00 - 99	empty	Instance number of the SAP system
OSUsername	string	empty	<sidadm>-user
OSPassword	string	empty	Password of the <sidadm>-user

Sensor-specific parameters

Parameter name	Possible values	Default	Description
Minutes	number | 1 - n	10	Past minutes to check
ErrorCodes	<code1>,<code2>,<code3>,... | FILE:<filename>	FILE:Default.preset	Error Codes to search for. There are two possible ways to maintain this parameter: Using custom set of error codes Syntax: <code1>,<code2>,<code3>,... Using custom set of error codes from file in SAP_Syslog_Monitor folder Syntax: FILE:<filename> Using predefined set of error codes from file in SAP_Syslog_Monitor folder Syntax: FILE:<filename>
Users	<Username1>,<Username2>,...	*	Only count Syslog entries with the given users. Use * as wildcard.
Protocol	http | https	http	Used protocol for the connection to sapstartsrv

Presets

File name	Description
Default.preset	Default set of error codes which are relevant for SAP Basis.
Security.preset	Set of security depending error codes. (E.g. abusing debugging function or audit errors)

info

If you want to customize a preset, please copy the file and maintain it under your own name. Otherwise your changes will be overwritten with the next Scansor update.

Channels

Channel name	Description	Lookup file
ServerName - Entries	Entries total
ServerName - Information	Entries marked as "Information"
ServerName - Warning	Entries marked as "Warning"
ServerName - HighPrio	Entries marked as "HighPrio"
ServerName - VeryHighPrio	Entries marked as "VeryHighPrio"
ServerName - Found Codes	Entries which are searched by "Error Codes"

Troubleshooting

Symptom

Possible solution

Receiving error message There is an error in XML document (2, 4542627)

This probably occurs due to a known SAP bug, which is described here: Support SAP. You could now use the parameter rslg/max_diskspace/local to see how large the log file (parameter rslg/local/file) may become, to estimate when the file will be regenerated. You could save the results of ReadABAPSyslog in an xml and check, whether a special character is causing the problem: sapcontrol -nr <nr> -function ReadABAPSyslog

Important notes

warning

Please check the limits if they fit for your alerting.

Changelog

Version	Changes
2023.09	Added parameter to use https for sapstartsrv connection
2022.08	Added preset for Security and transferred default value for parameter "ErrorCodes" to Default.preset Added filter for users to only read entries depending on one or more specified users
1.4.0.3	Fixed wrong counting by ErrorCode
1.4.0.1	Rebuild for new signature of AddChannel method
1.4.0.0	Build for installer 1.4.0
1.3.6.0	First stable release