Back to Geneos FAQ

Internal documentation only

This page has been marked as draft.

FKM - Unexpected Alert Behaviour Due to Overlapping Regex Fail and Clear Patterns

Related to Copied

Geneos FKM (File Keyword Monitor) Copied

Context: This guide addresses logic errors within the FKM plugin, specifically focusing on how the Gateway interprets Regular Expressions when evaluating log file transitions.

Problem Copied

Unexpected alert behaviour when using regex-based fail and clear patterns in samplers.

Possible cause(s) Copied

• Root Cause 1:

Fail and clear regex patterns overlap.

Example:

1. Fail pattern: disconnected
2. Clear pattern: connected

Since connected is contained within disconnected, matching logic may produce unexpected behaviour.

• Root Cause 2:

Clear pattern is too generic or not strictly defined.

Lack of anchors (^, $) or boundaries may cause unintended matches.

• Root Cause 3:

The monitored file is opened or modified in a way that interferes with file pointer tracking.

Some editors may rewrite or lock files during edits, preventing proper detection of new content.

Possible solution(s) Copied

• Solution Root Cause 1:

Ensure fail and clear regex patterns are mutually exclusive.

1. Avoid substring overlap.
2. Make patterns precise.
3. Test patterns independently before deployment.

• Solution Root Cause 2:

Use stricter regex definitions:

1. Add word boundaries (\b)
2. Use anchors (^, $) where applicable
3. Avoid overly broad matching

• Solution Root Cause 3:

Avoid opening monitored log files in editors during testing.

Related article(s) Copied

• https://docs.itrsgroup.com/docs/geneos/current/processing/gateway-administration/geneos_timeformats_tr/index.html#Heading-regular-expression-types-used-in-plugins
• https://docs.itrsgroup.com/docs/geneos/current/collection/fkm-config/index.html#Heading-regular-expressions