My apologies. Here is the log sample that I am trying to capture
---------------------------------------- Timestamp: 6/16/2008 4:23:51 AM Message: linkedTableName = |bcp_ACCOUNTNAME_2722149_20080616042256 as S | Thread Name: T_0001 Extended Properties: ---------------------------------------- .... other stuff here... ----------------------------------------------------------------------- 06/16/2008 04:25:31 Type : System.Net.WebException, System, Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77e5d561934f089 Message : The operation has timed-out. Source : System.Web.Services Help link : Status : Timeout ... more stuff .... SEC Rule type=pair ptype=RegExp pattern=^Message\:\s+(\S+)\s=\s\|(bcp)\_(\w+)\_(\d+)\_(\d+)\sas\sS\s\| desc=ACCOUNT: $3 :: Job: $4 action=logonly type=Single ptype=RegExp6 pattern=Type\s\:\s(System\.Net\.WebException)(.*)\nMessage\s\:\s(.*)\nSo urce\s\:\s(.*)\nHelp\slink\s\:\s(.*)\nStatus\s\:\s(.*) desc=JOB FAILED: $1 $6 action=logonly The 'RegExp6' worked great... now what I really need is to be able to report on both events. The first pattern will happen repeatedly, the second pattern only appears if there is an error. So I want SEC to watch for the 1st pattern, and if the second pattern is found, output the mux of the two... Something like "ACCOUNT: $3 :: Job: $4 JOB FAILED: $1 $6" I am pretty sure it can be done w/ contexts, but I have never been able to get them to work correctly. Thanks for the help, - Reynold -----Original Message----- From: John P. Rouillard [mailto:[EMAIL PROTECTED] Sent: Tuesday, December 09, 2008 2:29 PM To: Reynold McGuire Cc: [email protected] Subject: Re: [Simple-evcorr-users] Multi-Line RegEx problem In message <[EMAIL PROTECTED] t>, "Reynold McGuire" writes: > >I'm attempting to match > >Type : System.Net.WebException, System, Version=1.0.5000.0, >Culture=neutral, PublicKeyToken=b77a5c561934e089 >Message : The operation has timed-out. >Source : System.Web.Services >Help link : >Status : Timeout > >With the following pattern... > >Type\s\:\s(System.Net.WebException)(.*)\nMessage\s\:\s(The operation has >timed-out.)\nSource(.*)\nHelp(.*)\nStatus\s\:\s(Timeout) > >But it doesn't seem to catch it. > >Any help would be appreciated. What is the pattern type? It should be regexp6. If not it only matches against a single line from the buffer. BTQ, in general it is better to post the entire SEC configuration rule when asking these types of questions. -- -- rouilj John Rouillard ======================================================================== === My employers don't acknowledge my existence much less my opinions. ------------------------------------------------------------------------------ SF.Net email is Sponsored by MIX09, March 18-20, 2009 in Las Vegas, Nevada. The future of the web can't happen without you. Join us at MIX09 to help pave the way to the Next Web now. Learn more and register at http://ad.doubleclick.net/clk;208669438;13503038;i?http://2009.visitmix.com/ _______________________________________________ Simple-evcorr-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
