On 04/19/2011 04:40 PM, John Grasett wrote:
> I figured this one out on my own, should have got it long ago
> really...its a simple as putting:
>
> eval %server "$2" =~ m/.*\/(.*)\.SystemOut\.log$/;
>
> into my action line.
John,
you could also try rewriting the 'pattern' field as
pattern=sub { if ($_[0] =~ /.*(SRVE0255E).*/) { my($temp) = $1; \
return ($temp, $_[1] =~ m/.*\/(.*)\.SystemOut\.log$/); } else { return
0; } }
As I mentioned in my previous mail, the statement
return ($1, $_[1] =~ m/.*\/(.*)\.SystemOut\.log$/)
would return a list with $1 set to match value from the expression
m/.*\/(.*)\.SystemOut\.log$/. In order to prevent this, save the
previous value to $temp and return this as the first list element.
Calling the 'eval' action is also a way to crack the problem, but
PerlFunc pattern is compiled only once at SEC startup, while eval code
is compiled before each execution. Thus PerlFunc pattern is by far more
efficient.
kind regards,
risto
>
> Thanks again for your help and great SEC!
>
>
>
> -----John Grasett/Europe/Ascendant wrote: -----
>
> To: risto.vaara...@gmail.com
> From: John Grasett/Europe/Ascendant
> Date: 04/18/2011 03:21PM
> Cc: simple-evcorr-users@lists.sourceforge.net@
> Subject: Re: [Simple-evcorr-users] Suggestions for handling multiple
> streams/events - disabling alerting based on source, etc.
>
> Here is the conf I am testing and some of the output. I realize in
> the perfunc we have $0 and $1, but in the actions do these not
> become $1 and $2? I suppoe I am just wondering how I can manipulate
> the value for the input stream variabe in my actions to make it
> easier to read - ie rather than the full path and name of the
> minotired logfile, just a portion of the name that is a unique
> identifier.
>
>
> type=single
> ptype=perlfunc
> pattern=sub { if ($_[0] =~ /.*(SRVE0255E).*/) { \
> return ($1, $_[1] =~ m/.*\/(.*)\.SystemOut\.log$/); } else { return
> 0; } }
> context=!IGNORE_SRVE0255E_FOR_FILE_$2
> desc=$1:$2
> action=logonly Error reported by Application: %app on Layer: %layer:
> $1 caught in: $2; shellcmd %email $1 %layer %app $2 %mailto; create
> IGNORE_SRVE0255E_FOR_FILE_$2 60 logonly IGNORE_SRVE0255E_FOR_FILE_$2
> has Expired!
>
>
> Mon Apr 18 14:47:20 2011: Error reported by Application: WEC on
> Layer: PERF: PQWCSP5 caught in: PQWCSP5
> Mon Apr 18 14:47:20 2011: Executing shell command
> '/opt/monty/sec/emailException.sh PQWCSP5 PERF WEC PQWCSP5
> john_gras...@johnlewis.co.uk'
> Mon Apr 18 14:47:20 2011: Child 30939 created for command
> '/opt/monty/sec/emailException.sh PQWCSP5 PERF WEC PQWCSP5
> john_gras...@johnlewis.co.uk'
> Mon Apr 18 14:47:20 2011: Creating context
> 'IGNORE_SRVE0255E_FOR_FILE_PQWCSP5'
> Mon Apr 18 14:48:21 2011: Deleting stale context
> 'IGNORE_SRVE0255E_FOR_FILE_PQWCSP5'
> Mon Apr 18 14:48:21 2011: IGNORE_SRVE0255E_FOR_FILE_PQWCSP5 has
> Expired!
> Mon Apr 18 14:48:21 2011: Stale context
> 'IGNORE_SRVE0255E_FOR_FILE_PQWCSP5' deleted
>
> Whati happens is that using $1 and $2 in the action list, they both
> become what I think of as $2 (which is the manipulated $1 in the
> perlfunc.
>
> If I change the conf to be like this and use $0 and $2 in the action
> I get the entire log message...
>
> action=logonly Error reported by Application: %app on Layer: %layer:
> $0 caught in: $2; shellcmd %email $0 %layer %app $2 %mailto; create
> IGNORE_SRVE0255E_FOR_FILE_$2 60 logonly IGNORE_SRVE0255E_FOR_FILE_$2
> has Expired!
>
> So I am really changing the log line value in the function to only
> return the SRVE0255E in $1 and trying to change the log source $2 to
> only returns a portion of the name. It sort of works, but I seem to
> lose the value of the manipulkated log message if I try to
> manipulate the value of the log source.
>
> I have everything else I wanted to rest working fine, short lived
> context blocking of further alerts works just great...my email
> script is being triggered perfectly, its just his now ;)
>
> Thanks for your help!
>
>
>
>
> -----Risto Vaarandi <risto.vaara...@gmail.com> wrote: -----
>
> To: John Grasett <john.gras...@atech.com>
> From: Risto Vaarandi <risto.vaara...@gmail.com>
> Date: 04/17/2011 10:38AM
> Cc: simple-evcorr-users <simple-evcorr-users@lists.sourceforge.net>
> Subject: Re: [Simple-evcorr-users] Suggestions for handling
> multiple streams/events - disabling alerting based on source, etc.
>
> 2011/4/17 Risto Vaarandi <risto.vaara...@gmail.com>:
> > 2011/4/15 John Grasett <john.gras...@atech.com>:
> >> Yes, that sounds perfect. I could also then do this to not
> repeat on the
> >> same event in the same log.
> >>
> >> type=single
> >> ptype=perlfunc
> >> pattern=sub { if ($_[0] =~ /.*(SRVE0255E).*/) { \
> >> return ($1, $_[1]); } else { return 0; } }
> >> context=!IGNORE_SRVE0255E_FOR_FILE_$2
> >> desc=$0
> >> action=logonly Error reported by Application: %app on Layer:
> %layer:
> >> $1 caught in: $2; create IGNORE_SRVE0255E_FOR_FILE_$2
> >>
> >>
> >> One other thing I am triyng to do with no luck - change $2
> to be only part
> >> of the log path/filename:
> >>
> >> type=single
> >> ptype=perlfunc
> >> pattern=sub { if ($_[0] =~ /.*(SRVE0255E).*/) { \
> >> return ($1, $_[1], $_[2] =~ m/.*\/(.*)\.SystemOut\.log$/); }
> else { return
> >> 0; } }
> >> desc=$0
> >> action=logonly Error reported by Application: %app on Layer:
> %layer: $1
> >> caught in: $2
> >>
> >> or I try
> >>
> >> return ($1, $_[1] =~ m/.*\/(.*)\.SystemOut\.log$/); } else {
> return 0; } }
> >>
> >> But then I get bad output!
> >
> > John,
> > PerlFunc pattern function accepts two input parameters ($_[0] and
> > $_[1]), thus $_[2] is undefined for this pattern (PerlFunc2,
> > PerlFunc3, PerlFunc4 etc. take 2,4,6,... parameters).
>
> sorry for a typo -- PerlFunc takes 2 input parameters (one input
> line
> and one source name), PerlFunc2 takes 4 parameters (two input lines
> and two source names), PerlFunc3 takes 6, etc.
> regards,
> risto
>
>
>
> ------------------------------------------------------------------------------
> Benefiting from Server Virtualization: Beyond Initial Workload
> Consolidation -- Increasing the use of server virtualization is a top
> priority.Virtualization can reduce costs, simplify management, and improve
> application availability and disaster protection. Learn more about boosting
> the value of server virtualization. http://p.sf.net/sfu/vmware-sfdev2dev
>
>
>
> _______________________________________________
> Simple-evcorr-users mailing list
> Simple-evcorr-users@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
------------------------------------------------------------------------------
Benefiting from Server Virtualization: Beyond Initial Workload
Consolidation -- Increasing the use of server virtualization is a top
priority.Virtualization can reduce costs, simplify management, and improve
application availability and disaster protection. Learn more about boosting
the value of server virtualization. http://p.sf.net/sfu/vmware-sfdev2dev
_______________________________________________
Simple-evcorr-users mailing list
Simple-evcorr-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
