OMW:Read Multi-lined log files

I had seen so many questions about joining multiline log  as in OMW the Log Interceptor is parsing line by line, so if your data is scattered on different lines it can not be monitoring unless you imply a pre-processing script.

 

I have created the below script is to join multiple lines together but if match a certain keyword

If Wscript.Arguments.Count < 2 Then
    wscript.echo  "Usage cscript joinlines.vbs ""logfilepath"" ""machingtext"" "
    wscript.echo  "Ex:"
    wscript.echo  "cscript joinlines.vbs ""d:\logs\filename.log"" logfilename "
Else
Set args = WScript.Arguments
arg1 = WScript.Arguments.Item(0) 
match = WScript.Arguments.Item(1) 
Set fsObject = CreateObject("Scripting.FileSystemObject")
nodesFile = arg1
Set file = fsObject.GetFile(nodesFile)
Set line = file.OpenAsTextStream(1,TristateUseDefault)
dim arrFileLines()

Do Until line.AtEndOfStream
     Redim Preserve arrFileLines(l)
     arrFileLines(l) = line.ReadLine
     l = l + 1
Loop
For l = Ubound(arrFileLines) to LBound(arrFileLines) Step -1
If Instr(arrFileLines(l), match) > 0 then
wscript.echo "maching line  " & arrFileLines(l-1) &" " & arrFileLines(l) 
end if
Next

End if

Save the contents to joinlines.vbs

It can be implemented in different ways:

You can create a log file policy to search for your error message in each line as the sample below

20110326 08:00:13 expdp_SHARED_DATASTAGE.sql started ok
20110326 08:14:13 expdp_SHARED_DATASTAGE.sql completed ok with this output:
The job "EXPDP_USER". "SYS_EXPORT_SCHEMA_06" failed at 08:15:00: ERROR
20110327 08:00:13 expdp_SHARED_DATASTAGE2.sql started ok
20110327 08:14:13 expdp_SHARED_DATASTAGE2.sql completed ok with this output:
The job "EXPDP_USER2". "SYS_EXPORT_SCHEMA_02" failed at 08:15:00: ERROR
20110328 08:00:13 expdp_SHARED_DATASTAGE3.sql started ok
20110328 08:14:13 expdp_SHARED_DATASTAGE3.sql completed ok with this output:
The job "EXPDP_USER2". "SYS_EXPORT_SCHEMA_03" failed at 08:15:00: ERROR

1- You may create your rule to search for the word error and to send message and we can use the script as automatic action to get the previous lines and to append it to the annotation

Sample screenshots

2-You can create the policy to pre-process the log  and write the output to a text file to be read.

cscript /nologo log.vbs backup.log ERROR >c:\windows\temp\joinedlines.txt

 

 

Ref: http://forums13.itrc.hp.com/service/forums/questionanswer.do?threadId=1474985