At work, the production environment of FileNet P8 5.2 is deployed on several Oracle WebLogic server instances. This means when a problem crops up, I have a lot of of log files to analyze…. Not an easy task to find and correlate an error with so many instances and log files.
A solution exists for this madness of log files… In fact we have Splunk to ingest and to manage the log files of several applications. But Splunk is licensed by volume, and it’s expensive, and I can’t touch it… Not helping my work, so…
So I’m checking out logstash and it’s web interface Kibana.
The main FileNet P8 5.2 log files are the p8_server_error.log file and the pesvr_system.log file, for Content Engine and Process Engine.
These files are located under the Content Engine domain on a directory named FileNet and sub-divided by server instance.
So to keep thing short, here it is a logstash agent file that monitors and sends the logs to a REDIS remote instance:
input {
## P8 Content Engine CE1 Server Log
file {
type => “IBMP8_CE”
path => [ “/weblogic/user_projects/domains/fnce/FileNet/CeServer01/p8_server_error.log” ]
codec => multiline {
##pattern => “^\s”
pattern => “^%{TIMESTAMP_ISO8601}”
negate => true
what => “previous”
}
tags => [“P8CEServerLog”]
}
## P8 Process Engine CE1 System Log
file {
type => “IBMP8_PE”
path => [ “/weblogic/user_projects/domains/fnce/FileNet/CeServer01/pesvr_system.log” ]
codec => multiline {
##pattern => “^\s”
pattern => “^(?>\d\d){1,2}”
negate => true
what => “previous”
}
tags => [“P8CEServerLog”]
}
}
output {
stdout { codec => rubydebug }
redis { host => “redis_server.domain.com” data_type => “list” key => “logstash” }
}
You should change the redis_server.domain.com to your redis real ip/name, and after debugging, disable the stdout line.
Yo can add several input files for each server instance that is co-located on the same server machine.