Alerting on Log Patterns in Java

A comprehensive real-time log monitoring and alerting system that detects patterns, anomalies, and specific conditions in application logs with multiple notification channels.

Complete Implementation

1. Core Log Alerting System

package com.logalerting; import java.io.*; import java.nio.file.*; import java.util.*; import java.util.concurrent.*; import java.util.regex.*; import java.time.*; import java.time.format.*; /** * Advanced Log Alerting System * Monitors log files in real-time, detects patterns, and triggers alerts */ public class LogAlertingSystem { private final ScheduledExecutorService scheduler; private final List<LogMonitor> logMonitors; private final AlertManager alertManager; private final Map<String, AlertRule> alertRules; private final Set<String> monitoredFiles; private final long checkIntervalMs; private final int maxBufferSize; private volatile boolean isRunning; private final Pattern logPattern; private final DateTimeFormatter logTimestampFormat; public LogAlertingSystem() { this(1000, 10000, "logs/", "yyyy-MM-dd HH:mm:ss,SSS"); } public LogAlertingSystem(long checkIntervalMs, int maxBufferSize, String logDirectory, String timestampFormat) { this.checkIntervalMs = checkIntervalMs; this.maxBufferSize = maxBufferSize; this.scheduler = Executors.newScheduledThreadPool(3); this.logMonitors = new CopyOnWriteArrayList<>(); this.alertManager = new AlertManager(); this.alertRules = new ConcurrentHashMap<>(); this.monitoredFiles = ConcurrentHashMap.newKeySet(); this.logPattern = Pattern.compile( "^(?<timestamp>\\d{4}-\\d{2}-\\d{2} \\d{2}:\\d{2}:\\d{2},\\d{3}) " + "\\[(?<thread>.*?)\\] " + "(?<level>\\w+) " + "(?<logger>.*?) - " + "(?<message>.*)$" ); this.logTimestampFormat = DateTimeFormatter.ofPattern(timestampFormat); initializeDefaultRules(); discoverLogFiles(logDirectory); } /** * Start log monitoring */ public void startMonitoring() { if (isRunning) { System.out.println("Log alerting system is already running"); return; } System.out.println("Starting log alerting system..."); isRunning = true; // Start monitoring each log file for (String logFile : monitoredFiles) { LogMonitor monitor = new LogMonitor(logFile); logMonitors.add(monitor); scheduler.scheduleAtFixedRate(monitor, 0, checkIntervalMs, TimeUnit.MILLISECONDS); } // Start alert manager scheduler.scheduleAtFixedRate(alertManager, 0, checkIntervalMs, TimeUnit.MILLISECONDS); System.out.println("Log alerting system started. Monitoring " + monitoredFiles.size() + " log files"); } /** * Stop log monitoring */ public void stopMonitoring() { if (!isRunning) { return; } System.out.println("Stopping log alerting system..."); isRunning = false; scheduler.shutdown(); try { if (!scheduler.awaitTermination(5, TimeUnit.SECONDS)) { scheduler.shutdownNow(); } } catch (InterruptedException e) { scheduler.shutdownNow(); Thread.currentThread().interrupt(); } generateMonitoringReport(); System.out.println("Log alerting system stopped"); } /** * Discover log files in directory */ private void discoverLogFiles(String logDirectory) { try { Path logDir = Paths.get(logDirectory); if (!Files.exists(logDir)) { System.warn("Log directory does not exist: " + logDirectory); return; } Files.walk(logDir) .filter(path -> Files.isRegularFile(path)) .filter(path -> path.toString().endsWith(".log")) .forEach(path -> monitoredFiles.add(path.toString())); System.out.println("Discovered " + monitoredFiles.size() + " log files"); } catch (IOException e) { System.err.println("Error discovering log files: " + e.getMessage()); } } /** * Initialize default alert rules */ private void initializeDefaultRules() { // Error level alerts addAlertRule(new AlertRule("ERROR_ALERT", "ERROR", "Error detected in application logs", AlertSeverity.HIGH, 1, 60)); // Exception patterns addAlertRule(new AlertRule("EXCEPTION_ALERT", ".*Exception:.*|.*Error:.*", "Exception detected in logs", AlertSeverity.HIGH, 3, 120)); // High frequency error alerts addAlertRule(new AlertRule("FREQUENT_ERRORS", "ERROR", "High frequency of errors detected", AlertSeverity.MEDIUM, 10, 300)); // Performance pattern alerts addAlertRule(new AlertRule("SLOW_OPERATION", ".*execution time: \\d{4,}ms.*", "Slow operation detected", AlertSeverity.MEDIUM, 5, 600)); // Memory warning alerts addAlertRule(new AlertRule("MEMORY_WARNING", ".*Memory.*low.*|.*GC.*overhead.*", "Memory-related warning detected", AlertSeverity.MEDIUM, 2, 300)); // Authentication failure alerts addAlertRule(new AlertRule("AUTH_FAILURE", ".*Authentication failed.*|.*Login failure.*", "Authentication failure detected", AlertSeverity.HIGH, 5, 300)); } }

2. Log Monitoring and Parsing

 /** * Individual log file monitor */ private class LogMonitor implements Runnable { private final String logFilePath; private long lastReadPosition; private final RandomAccessFile logFile; private final Map<String, Pattern> compiledPatterns; private final CircularBuffer<LogEntry> recentEntries; public LogMonitor(String logFilePath) throws IOException { this.logFilePath = logFilePath; this.lastReadPosition = getFileSize(logFilePath); this.logFile = new RandomAccessFile(logFilePath, "r"); this.compiledPatterns = new ConcurrentHashMap<>(); this.recentEntries = new CircularBuffer<>(maxBufferSize); // Compile patterns for all rules for (AlertRule rule : alertRules.values()) { compiledPatterns.put(rule.getId(), Pattern.compile(rule.getPattern(), Pattern.CASE_INSENSITIVE)); } } @Override public void run() { try { monitorLogFile(); } catch (Exception e) { System.err.println("Error monitoring log file " + logFilePath + ": " + e.getMessage()); } } private void monitorLogFile() throws IOException { long currentSize = getFileSize(logFilePath); if (currentSize < lastReadPosition) { // Log file was rotated or truncated lastReadPosition = 0; } if (currentSize > lastReadPosition) { logFile.seek(lastReadPosition); String line; while ((line = logFile.readLine()) != null) { processLogLine(line); } lastReadPosition = logFile.getFilePointer(); } } private void processLogLine(String line) { if (line == null || line.trim().isEmpty()) { return; } LogEntry logEntry = parseLogEntry(line); if (logEntry != null) { recentEntries.add(logEntry); checkAlertRules(logEntry); } } private LogEntry parseLogEntry(String line) { try { Matcher matcher = logPattern.matcher(line); if (matcher.matches()) { String timestampStr = matcher.group("timestamp"); String thread = matcher.group("thread"); String level = matcher.group("level"); String logger = matcher.group("logger"); String message = matcher.group("message"); LocalDateTime timestamp = LocalDateTime.parse(timestampStr, logTimestampFormat); return new LogEntry(timestamp, thread, level, logger, message, line); } else { // Fallback for non-standard log formats return new LogEntry(LocalDateTime.now(), "unknown", "INFO", "unknown", line, line); } } catch (Exception e) { System.debug("Failed to parse log line: " + line); return null; } } private void checkAlertRules(LogEntry logEntry) { for (AlertRule rule : alertRules.values()) { Pattern pattern = compiledPatterns.get(rule.getId()); if (pattern != null && pattern.matcher(logEntry.getMessage()).find()) { alertManager.recordMatch(rule, logEntry); } } // Check for custom pattern matches checkCustomPatterns(logEntry); } private void checkCustomPatterns(LogEntry logEntry) { // Check for specific business logic patterns if (logEntry.getMessage().contains("OutOfMemoryError")) { alertManager.triggerImmediateAlert( new Alert("OUT_OF_MEMORY", "OutOfMemoryError detected", AlertSeverity.CRITICAL, logEntry)); } if (logEntry.getLevel().equals("ERROR") && logEntry.getMessage().contains("Database connection")) { alertManager.recordMatch( new AlertRule("DB_CONNECTION_ERROR", "Database connection.*ERROR", "Database connection issues", AlertSeverity.HIGH, 3, 60), logEntry); } } private long getFileSize(String filePath) throws IOException { return Files.size(Paths.get(filePath)); } public void close() { try { logFile.close(); } catch (IOException e) { System.err.println("Error closing log file: " + e.getMessage()); } } } /** * Log entry representation */ public static class LogEntry { private final LocalDateTime timestamp; private final String thread; private final String level; private final String logger; private final String message; private final String rawLine; public LogEntry(LocalDateTime timestamp, String thread, String level, String logger, String message, String rawLine) { this.timestamp = timestamp; this.thread = thread; this.level = level; this.logger = logger; this.message = message; this.rawLine = rawLine; } // Getters public LocalDateTime getTimestamp() { return timestamp; } public String getThread() { return thread; } public String getLevel() { return level; } public String getLogger() { return logger; } public String getMessage() { return message; } public String getRawLine() { return rawLine; } @Override public String toString() { return String.format("[%s] [%s] %s - %s", timestamp.format(DateTimeFormatter.ISO_LOCAL_DATE_TIME), level, logger, message); } }

3. Alert Rules and Management

 /** * Alert rule definition */ public static class AlertRule { private final String id; private final String pattern; private final String description; private final AlertSeverity severity; private final int threshold; private final long timeWindowSeconds; private final Set<String> tags; public AlertRule(String id, String pattern, String description, AlertSeverity severity, int threshold, long timeWindowSeconds) { this.id = id; this.pattern = pattern; this.description = description; this.severity = severity; this.threshold = threshold; this.timeWindowSeconds = timeWindowSeconds; this.tags = new HashSet<>(); } // Getters public String getId() { return id; } public String getPattern() { return pattern; } public String getDescription() { return description; } public AlertSeverity getSeverity() { return severity; } public int getThreshold() { return threshold; } public long getTimeWindowSeconds() { return timeWindowSeconds; } public Set<String> getTags() { return tags; } public void addTag(String tag) { tags.add(tag); } public boolean isThresholdReached(int matchCount, long timeWindowMs) { return matchCount >= threshold && timeWindowMs <= (timeWindowSeconds * 1000); } } /** * Alert severity levels */ public enum AlertSeverity { LOW, MEDIUM, HIGH, CRITICAL } /** * Alert manager */ private class AlertManager implements Runnable { private final Map<String, List<LogEntry>> ruleMatches; private final Map<String, Alert> activeAlerts; private final List<AlertNotifier> notifiers; private final Map<String, LocalDateTime> lastAlertTime; public AlertManager() { this.ruleMatches = new ConcurrentHashMap<>(); this.activeAlerts = new ConcurrentHashMap<>(); this.notifiers = new CopyOnWriteArrayList<>(); this.lastAlertTime = new ConcurrentHashMap<>(); // Add default notifiers notifiers.add(new ConsoleNotifier()); notifiers.add(new LogFileNotifier()); } @Override public void run() { checkAlertThresholds(); cleanupOldMatches(); checkActiveAlerts(); } public void recordMatch(AlertRule rule, LogEntry logEntry) { String ruleId = rule.getId(); ruleMatches.computeIfAbsent(ruleId, k -> new CopyOnWriteArrayList<>()) .add(logEntry); // Check if threshold is reached checkRuleThreshold(rule); } private void checkRuleThreshold(AlertRule rule) { String ruleId = rule.getId(); List<LogEntry> matches = ruleMatches.get(ruleId); if (matches != null && matches.size() >= rule.getThreshold()) { // Check time window LocalDateTime now = LocalDateTime.now(); LocalDateTime windowStart = now.minusSeconds(rule.getTimeWindowSeconds()); long matchesInWindow = matches.stream() .filter(entry -> entry.getTimestamp().isAfter(windowStart)) .count(); if (matchesInWindow >= rule.getThreshold()) { triggerAlert(rule, matches); } } } private void triggerAlert(AlertRule rule, List<LogEntry> matches) { String alertId = rule.getId() + "_" + System.currentTimeMillis(); Alert alert = new Alert(alertId, rule.getDescription(), rule.getSeverity(), matches); // Check if we should suppress this alert (recent duplicate) if (shouldSuppressAlert(rule.getId())) { System.debug("Suppressing duplicate alert: " + rule.getId()); return; } activeAlerts.put(alertId, alert); lastAlertTime.put(rule.getId(), LocalDateTime.now()); // Notify all registered notifiers for (AlertNotifier notifier : notifiers) { try { notifier.notify(alert); } catch (Exception e) { System.err.println("Error sending alert notification: " + e.getMessage()); } } System.warn("ALERT TRIGGERED: " + alert.getDescription() + " [Severity: " + alert.getSeverity() + "]"); } public void triggerImmediateAlert(Alert alert) { activeAlerts.put(alert.getId(), alert); for (AlertNotifier notifier : notifiers) { try { notifier.notify(alert); } catch (Exception e) { System.err.println("Error sending immediate alert: " + e.getMessage()); } } } private boolean shouldSuppressAlert(String ruleId) { LocalDateTime lastAlert = lastAlertTime.get(ruleId); if (lastAlert == null) { return false; } // Suppress duplicate alerts for 5 minutes return Duration.between(lastAlert, LocalDateTime.now()).toMinutes() < 5; } private void checkAlertThresholds() { for (AlertRule rule : alertRules.values()) { checkRuleThreshold(rule); } } private void cleanupOldMatches() { LocalDateTime cleanupThreshold = LocalDateTime.now().minusHours(1); for (List<LogEntry> matches : ruleMatches.values()) { matches.removeIf(entry -> entry.getTimestamp().isBefore(cleanupThreshold)); } } private void checkActiveAlerts() { // Check if active alerts should be auto-resolved Iterator<Map.Entry<String, Alert>> iterator = activeAlerts.entrySet().iterator(); while (iterator.hasNext()) { Map.Entry<String, Alert> entry = iterator.next(); Alert alert = entry.getValue(); if (alert.shouldAutoResolve()) { triggerAlertResolution(alert); iterator.remove(); } } } private void triggerAlertResolution(Alert alert) { Alert resolvedAlert = alert.resolve(); for (AlertNotifier notifier : notifiers) { try { notifier.notifyResolution(resolvedAlert); } catch (Exception e) { System.err.println("Error sending alert resolution: " + e.getMessage()); } } System.info("ALERT RESOLVED: " + resolvedAlert.getDescription()); } public void addNotifier(AlertNotifier notifier) { notifiers.add(notifier); } public List<Alert> getActiveAlerts() { return new ArrayList<>(activeAlerts.values()); } } /** * Alert representation */ public static class Alert { private final String id; private final String description; private final AlertSeverity severity; private final LocalDateTime triggerTime; private LocalDateTime resolveTime; private final List<LogEntry> triggeringEntries; private final Map<String, String> metadata; public Alert(String id, String description, AlertSeverity severity, LogEntry triggeringEntry) { this(id, description, severity, Collections.singletonList(triggeringEntry)); } public Alert(String id, String description, AlertSeverity severity, List<LogEntry> triggeringEntries) { this.id = id; this.description = description; this.severity = severity; this.triggerTime = LocalDateTime.now(); this.triggeringEntries = new ArrayList<>(triggeringEntries); this.metadata = new HashMap<>(); } // Getters public String getId() { return id; } public String getDescription() { return description; } public AlertSeverity getSeverity() { return severity; } public LocalDateTime getTriggerTime() { return triggerTime; } public LocalDateTime getResolveTime() { return resolveTime; } public List<LogEntry> getTriggeringEntries() { return triggeringEntries; } public Map<String, String> getMetadata() { return metadata; } public void addMetadata(String key, String value) { metadata.put(key, value); } public boolean shouldAutoResolve() { // Auto-resolve after 1 hour for non-critical alerts if (severity == AlertSeverity.CRITICAL) { return false; } Duration duration = Duration.between(triggerTime, LocalDateTime.now()); return duration.toHours() >= 1; } public Alert resolve() { this.resolveTime = LocalDateTime.now(); return this; } public boolean isResolved() { return resolveTime != null; } public String getSummary() { return String.format("[%s] %s - Triggered: %s, Entries: %d", severity, description, triggerTime.format(DateTimeFormatter.ISO_LOCAL_TIME), triggeringEntries.size()); } }

4. Notification System

 /** * Alert notifier interface */ public interface AlertNotifier { void notify(Alert alert) throws Exception; void notifyResolution(Alert alert) throws Exception; String getName(); } /** * Console notifier */ public static class ConsoleNotifier implements AlertNotifier { @Override public void notify(Alert alert) { System.err.println("🚨 ALERT: " + alert.getSummary()); for (LogEntry entry : alert.getTriggeringEntries()) { System.err.println(" - " + entry.getMessage()); } } @Override public void notifyResolution(Alert alert) { System.out.println("✅ ALERT RESOLVED: " + alert.getDescription()); } @Override public String getName() { return "ConsoleNotifier"; } } /** * Log file notifier */ public static class LogFileNotifier implements AlertNotifier { private final PrintWriter logWriter; public LogFileNotifier() { try { String logFile = "alerts.log"; logWriter = new PrintWriter(new FileWriter(logFile, true)); } catch (IOException e) { throw new RuntimeException("Failed to create alert log file", e); } } @Override public void notify(Alert alert) { logWriter.printf("[%s] ALERT: %s - %s%n", LocalDateTime.now(), alert.getSeverity(), alert.getDescription()); logWriter.flush(); } @Override public void notifyResolution(Alert alert) { logWriter.printf("[%s] ALERT RESOLVED: %s%n", LocalDateTime.now(), alert.getDescription()); logWriter.flush(); } @Override public String getName() { return "LogFileNotifier"; } } /** * Email notifier */ public static class EmailNotifier implements AlertNotifier { private final String smtpHost; private final String fromEmail; private final List<String> toEmails; public EmailNotifier(String smtpHost, String fromEmail, List<String> toEmails) { this.smtpHost = smtpHost; this.fromEmail = fromEmail; this.toEmails = new ArrayList<>(toEmails); } @Override public void notify(Alert alert) throws Exception { // Simplified email sending (in real implementation, use JavaMail) String subject = String.format("ALERT: %s [%s]", alert.getDescription(), alert.getSeverity()); StringBuilder body = new StringBuilder(); body.append("Alert Details:\n") .append("Description: ").append(alert.getDescription()).append("\n") .append("Severity: ").append(alert.getSeverity()).append("\n") .append("Time: ").append(alert.getTriggerTime()).append("\n") .append("Triggering Entries:\n"); for (LogEntry entry : alert.getTriggeringEntries()) { body.append(" - ").append(entry.getMessage()).append("\n"); } // In real implementation, send email using JavaMail API System.info("Would send email alert: " + subject); } @Override public void notifyResolution(Alert alert) throws Exception { String subject = String.format("ALERT RESOLVED: %s", alert.getDescription()); // Send resolution email System.info("Would send resolution email: " + subject); } @Override public String getName() { return "EmailNotifier"; } } /** * Slack notifier */ public static class SlackNotifier implements AlertNotifier { private final String webhookUrl; private final String channel; public SlackNotifier(String webhookUrl, String channel) { this.webhookUrl = webhookUrl; this.channel = channel; } @Override public void notify(Alert alert) throws Exception { String color = getColorForSeverity(alert.getSeverity()); String message = String.format(""" { "channel": "%s", "attachments": [ { "color": "%s", "title": "Alert: %s", "text": "%s", "fields": [ { "title": "Severity", "value": "%s", "short": true }, { "title": "Time", "value": "%s", "short": true } ] } ] } """, channel, color, alert.getDescription(), alert.getTriggeringEntries().get(0).getMessage(), alert.getSeverity(), alert.getTriggerTime()); // In real implementation, send HTTP POST to webhook System.info("Would send Slack alert: " + alert.getDescription()); } @Override public void notifyResolution(Alert alert) throws Exception { String message = String.format(""" { "channel": "%s", "text": "✅ Alert Resolved: %s" } """, channel, alert.getDescription()); // Send resolution message System.info("Would send Slack resolution: " + alert.getDescription()); } private String getColorForSeverity(AlertSeverity severity) { switch (severity) { case LOW: return "#36a64f"; case MEDIUM: return "#ffcc00"; case HIGH: return "#ff9900"; case CRITICAL: return "#ff0000"; default: return "#757575"; } } @Override public String getName() { return "SlackNotifier"; } }

5. Pattern Detection and Analysis

 /** * Add custom alert rule */ public void addAlertRule(AlertRule rule) { alertRules.put(rule.getId(), rule); System.info("Added alert rule: " + rule.getId()); } /** * Remove alert rule */ public void removeAlertRule(String ruleId) { alertRules.remove(ruleId); System.info("Removed alert rule: " + ruleId); } /** * Add log file to monitor */ public void addLogFile(String filePath) { if (monitoredFiles.add(filePath) && isRunning) { try { LogMonitor monitor = new LogMonitor(filePath); logMonitors.add(monitor); scheduler.scheduleAtFixedRate(monitor, 0, checkIntervalMs, TimeUnit.MILLISECONDS); System.info("Started monitoring log file: " + filePath); } catch (IOException e) { System.err.println("Failed to monitor log file: " + filePath); } } } /** * Remove log file from monitoring */ public void removeLogFile(String filePath) { if (monitoredFiles.remove(filePath)) { logMonitors.removeIf(monitor -> { if (monitor.logFilePath.equals(filePath)) { monitor.close(); return true; } return false; }); System.info("Stopped monitoring log file: " + filePath); } } /** * Search for patterns in recent logs */ public List<LogEntry> searchLogs(String pattern, Duration timeWindow) { List<LogEntry> results = new ArrayList<>(); Pattern compiledPattern = Pattern.compile(pattern, Pattern.CASE_INSENSITIVE); LocalDateTime cutoff = LocalDateTime.now().minus(timeWindow); for (LogMonitor monitor : logMonitors) { // This would need access to recentEntries which should be exposed // For now, return empty list - implementation would depend on storage strategy } return results; } /** * Get log statistics */ public LogStatistics getStatistics() { LogStatistics stats = new LogStatistics(); for (LogMonitor monitor : logMonitors) { // Collect statistics from each monitor // Implementation would depend on how we expose monitor data } return stats; } /** * Log statistics container */ public static class LogStatistics { private int totalLogEntries; private int errorCount; private int warningCount; private Map<String, Integer> levelDistribution; private Map<String, Integer> loggerDistribution; public LogStatistics() { this.levelDistribution = new HashMap<>(); this.loggerDistribution = new HashMap<>(); } // Getters and setters public int getTotalLogEntries() { return totalLogEntries; } public void setTotalLogEntries(int totalLogEntries) { this.totalLogEntries = totalLogEntries; } public int getErrorCount() { return errorCount; } public void setErrorCount(int errorCount) { this.errorCount = errorCount; } public int getWarningCount() { return warningCount; } public void setWarningCount(int warningCount) { this.warningCount = warningCount; } public Map<String, Integer> getLevelDistribution() { return levelDistribution; } public Map<String, Integer> getLoggerDistribution() { return loggerDistribution; } public void incrementLevel(String level) { levelDistribution.merge(level, 1, Integer::sum); } public void incrementLogger(String logger) { loggerDistribution.merge(logger, 1, Integer::sum); } }

6. Configuration and Report Generation

 /** * Configuration class */ public static class AlertingConfig { private long checkIntervalMs = 1000; private int maxBufferSize = 10000; private String logDirectory = "logs/"; private String timestampFormat = "yyyy-MM-dd HH:mm:ss,SSS"; private List<AlertNotifier> notifiers = new ArrayList<>(); private Map<String, String> notificationSettings = new HashMap<>(); public static AlertingConfig builder() { return new AlertingConfig(); } public AlertingConfig checkIntervalMs(long interval) { this.checkIntervalMs = interval; return this; } public AlertingConfig maxBufferSize(int size) { this.maxBufferSize = size; return this; } public AlertingConfig logDirectory(String directory) { this.logDirectory = directory; return this; } public AlertingConfig timestampFormat(String format) { this.timestampFormat = format; return this; } public AlertingConfig addNotifier(AlertNotifier notifier) { this.notifiers.add(notifier); return this; } public AlertingConfig notificationSetting(String key, String value) { this.notificationSettings.put(key, value); return this; } public LogAlertingSystem build() { LogAlertingSystem system = new LogAlertingSystem( checkIntervalMs, maxBufferSize, logDirectory, timestampFormat); for (AlertNotifier notifier : notifiers) { system.alertManager.addNotifier(notifier); } return system; } } /** * Generate monitoring report */ private void generateMonitoringReport() { try { String report = generateReport(); String fileName = "log-alerting-report-" + LocalDateTime.now().format(DateTimeFormatter.ofPattern("yyyyMMdd-HHmmss")) + ".html"; Files.writeString(Paths.get(fileName), report); System.out.println("Monitoring report generated: " + fileName); } catch (IOException e) { System.err.println("Failed to generate monitoring report: " + e.getMessage()); } } private String generateReport() { StringBuilder html = new StringBuilder(); html.append(""" <!DOCTYPE html> <html> <head> <title>Log Alerting System Report</title> <style> body { font-family: Arial, sans-serif; margin: 20px; } .header { background: #f0f0f0; padding: 20px; border-radius: 5px; } .section { margin: 20px 0; padding: 15px; border: 1px solid #ddd; border-radius: 5px; } .alert { background: #fff3cd; border-left: 4px solid #ffc107; padding: 10px; margin: 5px 0; } .critical { background: #f8d7da; border-left: 4px solid #dc3545; } .high { background: #ffeaa7; border-left: 4px solid #fdcb6e; } .metric { display: inline-block; margin: 0 20px 10px 0; padding: 10px; background: #e9ecef; border-radius: 3px; } table { width: 100%; border-collapse: collapse; margin: 10px 0; } th, td { border: 1px solid #ddd; padding: 8px; text-align: left; } th { background-color: #f2f2f2; } </style> </head> <body> """); html.append("<div class='header'>") .append("<h1>Log Alerting System Report</h1>") .append("<p><strong>Generated:</strong> ").append(LocalDateTime.now()).append("</p>") .append("</div>"); // System summary html.append("<div class='section'>") .append("<h2>System Summary</h2>") .append("<div class='metric'><strong>Monitored Files:</strong> ").append(monitoredFiles.size()).append("</div>") .append("<div class='metric'><strong>Alert Rules:</strong> ").append(alertRules.size()).append("</div>") .append("<div class='metric'><strong>Active Alerts:</strong> ").append(alertManager.getActiveAlerts().size()).append("</div>") .append("</div>"); // Active alerts List<Alert> activeAlerts = alertManager.getActiveAlerts(); if (!activeAlerts.isEmpty()) { html.append("<div class='section'>") .append("<h2>Active Alerts</h2>"); for (Alert alert : activeAlerts) { String alertClass = "alert " + alert.getSeverity().toString().toLowerCase(); html.append("<div class='").append(alertClass).append("'>") .append("<h3>").append(alert.getDescription()).append("</h3>") .append("<p><strong>Severity:</strong> ").append(alert.getSeverity()).append("</p>") .append("<p><strong>Triggered:</strong> ").append(alert.getTriggerTime()).append("</p>") .append("<p><strong>Entries:</strong> ").append(alert.getTriggeringEntries().size()).append("</p>") .append("</div>"); } html.append("</div>"); } // Alert rules html.append("<div class='section'>") .append("<h2>Alert Rules</h2>") .append("<table>") .append("<tr><th>ID</th><th>Description</th><th>Pattern</th><th>Severity</th><th>Threshold</th><th>Time Window</th></tr>"); for (AlertRule rule : alertRules.values()) { html.append("<tr>") .append("<td>").append(rule.getId()).append("</td>") .append("<td>").append(rule.getDescription()).append("</td>") .append("<td>").append(rule.getPattern()).append("</td>") .append("<td>").append(rule.getSeverity()).append("</td>") .append("<td>").append(rule.getThreshold()).append("</td>") .append("<td>").append(rule.getTimeWindowSeconds()).append("s</td>") .append("</tr>"); } html.append("</table></div>"); html.append("</body></html>"); return html.toString(); }

7. Utility Classes

 /** * Circular buffer for storing recent log entries */ private static class CircularBuffer<T> { private final T[] buffer; private int head; private int tail; private int size; private final int capacity; @SuppressWarnings("unchecked") public CircularBuffer(int capacity) { this.capacity = capacity; this.buffer = (T[]) new Object[capacity]; this.head = 0; this.tail = 0; this.size = 0; } public synchronized void add(T item) { buffer[head] = item; head = (head + 1) % capacity; if (size < capacity) { size++; } else { tail = (tail + 1) % capacity; } } public synchronized List<T> getRecentItems(int count) { count = Math.min(count, size); List<T> items = new ArrayList<>(count); for (int i = 0; i < count; i++) { int index = (head - 1 - i + capacity) % capacity; items.add(buffer[index]); } Collections.reverse(items); return items; } public synchronized int size() { return size; } } /** * Add notifier to alert manager */ public void addNotifier(AlertNotifier notifier) { alertManager.addNotifier(notifier); } /** * Get active alerts */ public List<Alert> getActiveAlerts() { return alertManager.getActiveAlerts(); } /** * Manual alert trigger for testing */ public void triggerTestAlert() { LogEntry testEntry = new LogEntry( LocalDateTime.now(), "test-thread", "ERROR", "TestLogger", "This is a test error message for alert verification", "Raw test log line" ); alertManager.triggerImmediateAlert( new Alert("TEST_ALERT", "Test alert triggered manually", AlertSeverity.MEDIUM, testEntry)); } } // Utility class for system output class System { public static void info(String message) { java.lang.System.out.println("[INFO] " + message); } public static void warn(String message) { java.lang.System.out.println("[WARN] " + message); } public static void error(String message) { java.lang.System.err.println("[ERROR] " + message); } public static void debug(String message) { java.lang.System.out.println("[DEBUG] " + message); } }

8. Usage Examples

/** * Demo and usage examples */ public class LogAlertingDemo { public static void main(String[] args) throws Exception { // Create alerting system with configuration LogAlertingSystem system = LogAlertingSystem.AlertingConfig.builder() .checkIntervalMs(2000) .maxBufferSize(5000) .logDirectory("application-logs/") .addNotifier(new LogAlertingSystem.ConsoleNotifier()) .addNotifier(new LogAlertingSystem.SlackNotifier( "https://hooks.slack.com/services/...", "#alerts")) .build(); // Add custom alert rules system.addAlertRule(new LogAlertingSystem.AlertRule( "CUSTOM_ERROR", ".*Payment.*failed.*|.*Transaction.*error.*", "Payment processing error", LogAlertingSystem.AlertSeverity.HIGH, 3, 300)); // Start monitoring system.startMonitoring(); // Add another log file dynamically system.addLogFile("another-app.log"); // Let it run for a while Thread.sleep(60000); // Check active alerts List<LogAlertingSystem.Alert> activeAlerts = system.getActiveAlerts(); System.out.println("Active alerts: " + activeAlerts.size()); // Stop monitoring system.stopMonitoring(); } }

Features

Real-time Log Monitoring: Tails log files and processes new entries
Pattern-based Alerting: Regex patterns for flexible alert conditions
Multiple Notification Channels: Console, Email, Slack, Log file
Threshold-based Alerts: Configurable thresholds and time windows
Alert Suppression: Prevents alert spam for duplicate conditions
Auto-resolution: Automatic alert resolution after configured periods
Comprehensive Reporting: HTML reports with system status
Dynamic Configuration: Add/remove rules and log files at runtime
Performance Optimized: Efficient circular buffer for log storage

Usage Examples

Basic Setup

LogAlertingSystem system = new LogAlertingSystem(); system.startMonitoring();

Advanced Configuration

LogAlertingSystem system = LogAlertingSystem.AlertingConfig.builder() .checkIntervalMs(1000) .logDirectory("/var/log/myapp/") .addNotifier(new SlackNotifier(webhookUrl, "#alerts")) .build();

Custom Alert Rules

AlertRule rule = new AlertRule( "SLOW_QUERY", ".*Query execution time: \\d{4,}ms.*", "Slow database queries detected", AlertSeverity.MEDIUM, 5, 600); system.addAlertRule(rule);

This log alerting system provides comprehensive monitoring and alerting capabilities for Java applications, helping operations teams quickly identify and respond to issues through real-time pattern detection and multi-channel notifications.