Log Analysis (Appended) service

The Log Analysis (Appended) is an agent-based service and works only on log files that are located on a file system that is local to the agent. It enables you to monitor text that an application, such as a web server or a firewall, writes to its log file. During the monitoring process, the service executes a check on the log file at regular intervals, and it scans logged lines that were added to the file since its last execution. Through the use of regular expression matching and time stamp comparison, this service can notify you when the application stops logging to its log file, or when it logs an error or a warning message. This service monitors up to four log files for each device and supports wide characters.

For information on adding the service to a device see Add and configure a Log Analysis (Appended) service.

Service TypeLog Appended
Instances on a Device10
Device ClassServer - Generic and Server - Windows
Monitored ByAgent (Windows, Red Hat Enterprise Linux, and macOS)
Scan Interval5 minutes
Log File Name and PathThe monitored directory path and name of the log file. You specify a complete or partial name and path. You must specify the directory name as well, for example: c:\test.log

Status details

Status DetailDescription
File Size (Bytes)

N-able N-central reads the size of the file and compares it with the values your threshold specifications.

Threshold options can vary for each specified regular expression.

Regular Expressions
(1 to 6)
The thresholds for the regular expressions that you specified on the Service Details tab.
Difference in minutes...N-able N-central compares the values that you specify in this field with the age of the log file that is calculated by the agent. The age is the difference between the time the log file was generated and the current time.
Line Count of Log FileThe number of lines in the file that are scanned and compared with your threshold specifications.
The line count matched regex...The number of lines, in the log file, on which the keyword has been located and returned by the agent. This information is displayed for each regular expression on the status details screen for the service, any applicable reports, and any triggered notifications, except for numeric pages.
The first line matchedThe first 250 characters of the first line, in the log file, containing the matching keyword returned by the agent. This information is displayed on the service's status details screen, any applicable reports, and any triggered notifications, except for numeric pages.