Articles in this section

See more
Self help
Troubleshooting
["Troubleshooting"]

Geneos - FKM reading file from the beginning

Avatar
ITRS Support
  • Updated
Follow

Related to:

Old FKM alerts, unexpected FKM alerts, FKM reading file from beginning, FKM re-reading file, alerts on accepted triggers, FKM reading file from the start

Problem

User is noticing the FKM plug-in is reading file from the beginning, and alerting on previously reported triggers. 

Possible Cause(s)

Root Cause 1 - the Rewind option is ticked (disabled by default) on the FKM sampler. This will cause the FKM plugin to read the file from the beginning under the following conditions:

mceclip1.png

  • A change is made to the FKM sampler configuration
  • The Gateway or Netprobe is restarted

In general the FKM Rewind option should not be changed from the default, except during the development of new sampler configurations or for diagnostics.

Root Cause 2 - If the file path contains wildcards ('*' and '?') and the Wildcard Monitor All Matches setting is disabled (by default), the FKM plug-in will read the file from the beginning whenever it detects the file is new, specifically if the file's inode (File ID in Windows) changes, regardless of the rewind setting.
This can have an unwanted effect when the wildcarded file path picks up two matching files that are being written to by external applications. The newest file may flip-flop every sample and it's entire contents re-read each time.
For example, the below FKM sampler is monitoring the following file path: /export/home/mmuniz/FKM_TEST_FOLDER/application*.log
Notice both the Rewind and Wildcard monitor all matches settings are disabled.  
mceclip5.png
mceclip4.png
Below is an example of the resulting dataview. Notice the following:
  • The first two highlighted entries picked up at 11:13:02 are for application_1.log.
  • Following that, the FKM plug-in picks up keys from the application_2.log at 11:42:42.
  • Then, at 11:15:42 we see the FKM plug-in treats the application_1.log file as a new file, and re-reads it from the beginning and alerts on the new and previously alerted log file entries. 
mceclip8.png

Possible Solution(s)

Solution Root Cause 1 - When the rewind option is un-ticked (by default), the FKM plug-in reads the file from the end on start-up.

Solution Root Cause 2 (1) - Enable the Wildcard monitor all matches setting under the FKM advanced tab at the bottom of the sampler record.  

mceclip10.png

This will create a a separate entry for each filename in the FKM sampler and avoid repeat alerts as seen below:

mceclip11.png

Solution Root Cause 2 (2)- In addition to the above solution, if you wish to not see one of the files listed by the FKM dataview, you can move the file to another directory. 

Related Articles

If Issue Persists

  • Please contact with our Client Services team via the chat service box available in any of our websites or via email to support@itrsgroup.com
    mceclip0.png

  • Make sure you provide to us:
    • The troubleshooting steps done (refer to the Possible Cause and Solution sections of this article)
    • Date and time of the issue
    • FKM sampler.xml
    • Screenshot of the FKM dataview if possible
    • Complete Gateway Log 
    • Gateway and Netprobe version

Related articles

Comments

0 comments

Please sign in to leave a comment.