To monitor multiple files using a OMW log file monitor policy, you have to configure the policy to list those files separated by spaces.
Normally in Unix-based systems if you used ls command with wildcards, the result will be the full files path and separated by spaces
In Windows, dir is not delivering the same result as
if you try dir /b /s it will show each file in separate line
if you used /w command it display the files without path, so I created the below script to list the files with /w and add the path to the output
If Wscript.Arguments.Count < 2 Then
wscript.echo "Usage cscript listlogs.vbs ""directry"" filename "
wscript.echo "cscript listlogs.vbs ""d:logs"" logfilename "
directory = WScript.Arguments.Item(0)
Set objShell = WScript.CreateObject("WScript.Shell")
command = "cmd /c dir /l /w " & directory & "*" &filename & "*.log"
Set oExec = objShell.Exec(Command)
Do While Not oExec.StdOut.AtEndOfStream
commandoutput = oExec.StdOut.ReadLine()
If Instr(commandoutput, ".log") > 0 then
replaced = replace(commandOutput,filename, directory & filename)
The next step is to deploy this script to your Managed Nodes, we may create new Instrumentation by creating a new folder under %ovdatadir%sharedInstrumentationCategories , lets name it LogFileMonitor
Browse to the Policy Group or to Policy Management –> Policies grouped by type-> Agent Policies –> Logfile Entry
In the Log file path type <`c:windowssystem32cscript.exe /nolog listlog.vbs c:Ciscolog cisco`> but during the test it work with me as <`c:windowssystem32cscript.exe /nologo “%ovdatadir%”bininstrumentationlistlogs.vbs c:Ciscolog cisco`>
Save the policy, you may use Category option to automatically deploy the instrumentation with the policy (requires certain configuration)
Distribute the instrumentation,then deploy the policy to your managed nodes.
This was in response of HP Support forum question on ITRC Logfile Monitoring with File name changes after server reeboot