type=single
ptype=perlfunc
pattern=sub { if ($_[0] =~ /.*(SRVE0255E).*/) { \
return ($1, $_[1] =~ m/.*\/(.*)\.SystemOut\.log$/); } else { return 0; } }
context=!IGNORE_SRVE0255E_FOR_FILE_$2
desc=$1:$2
action="" Error reported by Application: %app on Layer: %layer: $1 caught in: $2; shellcmd %email $1 %layer %app $2 %mailto; create IGNORE_SRVE0255E_FOR_FILE_$2 60 logonly IGNORE_SRVE0255E_FOR_FILE_$2 has Expired!
Mon Apr 18 14:47:20 2011: Error reported by Application: WEC on Layer: PERF: PQWCSP5 caught in: PQWCSP5
Mon Apr 18 14:47:20 2011: Executing shell command '/opt/monty/sec/emailException.sh PQWCSP5 PERF WEC PQWCSP5 john_gras...@johnlewis.co.uk'
Mon Apr 18 14:47:20 2011: Child 30939 created for command '/opt/monty/sec/emailException.sh PQWCSP5 PERF WEC PQWCSP5 john_gras...@johnlewis.co.uk'
Mon Apr 18 14:47:20 2011: Creating context 'IGNORE_SRVE0255E_FOR_FILE_PQWCSP5'
Mon Apr 18 14:48:21 2011: Deleting stale context 'IGNORE_SRVE0255E_FOR_FILE_PQWCSP5'
Mon Apr 18 14:48:21 2011: IGNORE_SRVE0255E_FOR_FILE_PQWCSP5 has Expired!
Mon Apr 18 14:48:21 2011: Stale context 'IGNORE_SRVE0255E_FOR_FILE_PQWCSP5' deleted
Whati happens is that using $1 and $2 in the action list, they both become what I think of as $2 (which is the manipulated $1 in the perlfunc.
If I change the conf to be like this and use $0 and $2 in the action I get the entire log message...
action="" Error reported by Application: %app on Layer: %layer: $0 caught in: $2; shellcmd %email $0 %layer %app $2 %mailto; create IGNORE_SRVE0255E_FOR_FILE_$2 60 logonly IGNORE_SRVE0255E_FOR_FILE_$2 has Expired!
So I am really changing the log line value in the function to only return the SRVE0255E in $1 and trying to change the log source $2 to only returns a portion of the name. It sort of works, but I seem to lose the value of the manipulkated log message if I try to manipulate the value of the log source.
I have everything else I wanted to rest working fine, short lived context blocking of further alerts works just great...my email script is being triggered perfectly, its just his now ;)
Thanks for your help!
-----Risto Vaarandi <risto.vaara...@gmail.com> wrote: -----
To: John Grasett <john.gras...@atech.com>
From: Risto Vaarandi <risto.vaara...@gmail.com>
Date: 04/17/2011 10:38AM
Cc: simple-evcorr-users <simple-evcorr-users@lists.sourceforge.net>
Subject: Re: [Simple-evcorr-users] Suggestions for handling multiple streams/events - disabling alerting based on source, etc.
2011/4/17 Risto Vaarandi <risto.vaara...@gmail.com>:
> 2011/4/15 John Grasett <john.gras...@atech.com>:
>> Yes, that sounds perfect. I could also then do this to not repeat on the
>> same event in the same log.
>>
>> type=single
>> ptype=perlfunc
>> pattern=sub { if ($_[0] =~ /.*(SRVE0255E).*/) { \
>> return ($1, $_[1]); } else { return 0; } }
>> context=!IGNORE_SRVE0255E_FOR_FILE_$2
>> desc=$0
>> action="" Error reported by Application: %app on Layer: %layer:
>> $1 caught in: $2; create IGNORE_SRVE0255E_FOR_FILE_$2
>>
>>
>> One other thing I am triyng to do with no luck - change $2 to be only part
>> of the log path/filename:
>>
>> type=single
>> ptype=perlfunc
>> pattern=sub { if ($_[0] =~ /.*(SRVE0255E).*/) { \
>> return ($1, $_[1], $_[2] =~ m/.*\/(.*)\.SystemOut\.log$/); } else { return
>> 0; } }
>> desc=$0
>> action="" Error reported by Application: %app on Layer: %layer: $1
>> caught in: $2
>>
>> or I try
>>
>> return ($1, $_[1] =~ m/.*\/(.*)\.SystemOut\.log$/); } else { return 0; } }
>>
>> But then I get bad output!
>
> John,
> PerlFunc pattern function accepts two input parameters ($_[0] and
> $_[1]), thus $_[2] is undefined for this pattern (PerlFunc2,
> PerlFunc3, PerlFunc4 etc. take 2,4,6,... parameters).
sorry for a typo -- PerlFunc takes 2 input parameters (one input line
and one source name), PerlFunc2 takes 4 parameters (two input lines
and two source names), PerlFunc3 takes 6, etc.
regards,
risto
------------------------------------------------------------------------------ Benefiting from Server Virtualization: Beyond Initial Workload Consolidation -- Increasing the use of server virtualization is a top priority.Virtualization can reduce costs, simplify management, and improve application availability and disaster protection. Learn more about boosting the value of server virtualization. http://p.sf.net/sfu/vmware-sfdev2dev
_______________________________________________ Simple-evcorr-users mailing list Simple-evcorr-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
