Is there a way to create an error report based on a given date and time period? 

Other than scheduling a regular error report and extracting it, I don't think there is a way.

You can, if needed, create a trigger on a logging target to do it, if you're looking for a means to generate one when something happens.

And you know what.... the moment I hit the POST button I realize there is a way.

Tell me what you want to do and I'll be able to help you.

Hi Jospeh,

Can you help on this usecase.

I am bit sure this can be done using the event triggers in Log targets.

1) Can we trigger a pcap and error report once we have issue with DNS resolution i.e i mean where we get DNS Callback error for the backend.
Eg. Thu Sep 28 2023 19:41:33 [0x80e00048][network][error] xmlmgr(MainXMLManager): tid(----) gtid(-------): DNS Callback cannot resolve host 'xxxxxxxxxxxxxxxxx': returning error

2) Also, if our some Database is down i.e the SQL object is down and unable to reach the DB , it should generate a pcap.

Thanks

------------------------------
Sunil Chaurasia
------------------------------

I suspect you know the error code reported in the log when DNS fails for the SQL object goes down?

So, in your logging target (I'm not sure what UI you are using, but in the OLD pre-10.5 UI) locate the "Event Triggers" tab.

Add a new event trigger.

In the message ID field, put in the error code of interest, say, the error when DNS fails.

If multiple error messages result from the same code you provide, fill in a regular expression to isolate the DNS failure.

In both of these cases, you want to leave the "Only Once" radio turned "on"

In both of these cases, you want to leave the "Only this trigger" radio turned "on", but, make sure one doesn't shadow the other.

Then, in the CLI command, enter something like:

packet-capture-advanced all temporary:///DNSFailed.pcap 60 10000 9000

Follow the documentation here:

https://www.ibm.com/docs/en/datapower-gateway/2018.4?topic=commands-packet-capture-advanced

Repeat for the SQL going down, just be sure to give a unique value for the capture file name so if both go down, you don't have the SQL one overwriting the DNS one.

No, you cannot go back in time to capture an error report, but, going forward, there are ways to do so on such things as CPU thresholds and anything else you can imagine.

One is to use an external tool to monitor something like a CPU status and then, when the threshold is reached, generate an error report.  This will likely require some kind of scripting.

Another way, and I do this kind of thing all the time, is to create a processing rule scheduled through an XML Manager.  The processing rule will run every so many seconds.  When executed, it pulls the CPU status of the machine.  If it reaches the desired threshold, you can fire off a logging event.  You can create a custom category for this.  Then, build a logging target subscribed to the custom event, which can trigger error report creation (via CLI) when the event is received.

In both cases, though, you'll likely want to put in some kind of suppression time so in a prolonged event, you don't get 100 error reports.   Identical event detection and suppression is still supported in the logging target, though deprecated.  Though, there are other ways within the appliance by setting a system variable (oh no, say it ain't so!) and comparing the last event time to the current one.  Just name the variable very uniquely.

P.S.  Before anyone fusses about how not to use system variables, yaddah yaddah yaddah, API Connect spatters them all over the place, and this one would be used only by one process within the appliance, so it is safe.