Hi all ,
Problem resolved , the error was a internal error and happened when i defined
many route for the same outputIf you also have this problem , try to use only
one route per output
if you also want to parse some Oracle messages for Oracle RAC /cluster , be
careful of different format , the best way to parse seems to be that kind of
thing:
Exec if $raw_event =~
/^((\[\s+CSSD])(\d+-\d+-\d+\s\d+:\d+:\d+)(.\d+\s.\d+)(.\s.+))/\{\ $EventTime
= parsedate($3);\}
Using block , it's really much easier , try to catch only the block you want.
"parsedate" function must work for all cases and products in Oracle log date
(RAC /Database and EBS)
I will soon write some example for Oracle logs and give it for nxlog community.
Thanks for your help Botond , as always it was perfect!
Regards,
------------------------------------------------------------------------------
How ServiceNow helps IT people transform IT departments:
1. Consolidate legacy IT systems to a single system of record for IT
2. Standardize and globalize service processes across IT
3. Implement zero-touch automation to replace manual, redundant tasks
http://pubads.g.doubleclick.net/gampad/clk?id=51271111&iu=/4140/ostg.clktrk
_______________________________________________
nxlog-ce-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nxlog-ce-users
