Fixlet to reboot Computers based on log lines

Hello All, I am asking about capability of what I can do with a bigfix fixlet. So I am in a scenario where we need a fixlet that reboots the computer to run when a particular error shows up in a /computer/logs/log.out file for a particular time frame 9pm - 3am. Is it possible to write relevance that can do these sorts of verifications?

The only way now I know of being able to do this is to run a fixlet that runs a grep in the logs and outputs to a file and then basing the reboot fixlet on a value in the output of that file. Is that the only method that will work because that is hardly a clean method of making this happen.

Is that the reboot to occur 9pm thru 3am, or the error is recorded in that time frame?

How big is the log file?

Is it held open by some process?

Is the value you are looking for a simple string or more complex?

The relevance could be as simple as

exists file "/computer/logs/log.out" whose (exists lines whose (it contains "Error123") of it)

So were looking for an out of memory error between 9pm and 3am which will show within that time frame in the log file. The log files are large, at least they can be depending at what point were looking at the file. Were looking for a line along the lines of “StateManager. .DebugManager: java.lang.OutOfMemoryError”

In front of that error is a date string and time in military time followed by a unique ID and the logline. So something like:

2023-03-29 06:59:29, 93459843 StateManager. .DebugManager: java.lang.OutOfMemoryError

So I need to find if that error exists or shows up between 9pm - 3am and if it does follow through with a fixlet which reboots the device.

There is quite a lot to this

Firstly, the log file has to be parsed to get events between those times, and presumably not back into the past, with just recent events being of interest. It is an interesting problem, but I don’t have any slack time to spend at the moment.

You then need to ensure the action doesn’t keep triggering, but the options on the Execution tab should allow you to manage that

1 Like

Perhaps the log file be rotated daily there by keeping only one event of course that is assuming that the event only comes up once a day.