Login with Facebook

Monday, April 4, 2011

OMW:Read Multi-lined log files

I had seen so many questions about joining multiline log  as in OMW the Log Interceptor is parsing line by line, so if your data is scattered on different lines it can not be monitoring unless you imply a pre-processing script.


I have created the below script is to join multiple lines together but if match a certain keyword

If Wscript.Arguments.Count < 2 Then
wscript.echo "Usage cscript joinlines.vbs ""logfilepath"" ""machingtext"" "
wscript.echo "Ex:"
wscript.echo "cscript joinlines.vbs ""d:\logs\filename.log"" logfilename "
Set args = WScript.Arguments
arg1 = WScript.Arguments.Item(0)
match = WScript.Arguments.Item(1)
Set fsObject = CreateObject("Scripting.FileSystemObject")
nodesFile = arg1
Set file = fsObject.GetFile(nodesFile)
Set line = file.OpenAsTextStream(1,TristateUseDefault)
dim arrFileLines()

Do Until line.AtEndOfStream
Redim Preserve arrFileLines(l)
arrFileLines(l) = line.ReadLine
l = l + 1
For l = Ubound(arrFileLines) to LBound(arrFileLines) Step -1
If Instr(arrFileLines(l), match) > 0 then
wscript.echo "maching line " & arrFileLines(l-1) &" " & arrFileLines(l)
end if

End if

Save the contents to joinlines.vbs

It can be implemented in different ways:

You can create a log file policy to search for your error message in each line as the sample below

20110326 08:00:13 expdp_SHARED_DATASTAGE.sql started ok
20110326 08:14:13 expdp_SHARED_DATASTAGE.sql completed ok with this output:
The job "EXPDP_USER". "SYS_EXPORT_SCHEMA_06" failed at 08:15:00: ERROR
20110327 08:00:13 expdp_SHARED_DATASTAGE2.sql started ok
20110327 08:14:13 expdp_SHARED_DATASTAGE2.sql completed ok with this output:
The job "EXPDP_USER2". "SYS_EXPORT_SCHEMA_02" failed at 08:15:00: ERROR
20110328 08:00:13 expdp_SHARED_DATASTAGE3.sql started ok
20110328 08:14:13 expdp_SHARED_DATASTAGE3.sql completed ok with this output:
The job "EXPDP_USER2". "SYS_EXPORT_SCHEMA_03" failed at 08:15:00: ERROR

1- You may create your rule to search for the word error and to send message and we can use the script as automatic action to get the previous lines and to append it to the annotation

Sample screenshots



2-You can create the policy to pre-process the log  and write the output to a text file to be read.

cscript /nologo log.vbs backup.log ERROR >c:\windows\temp\joinedlines.txt



Ref: http://forums13.itrc.hp.com/service/forums/questionanswer.do?threadId=1474985


Anonymous said...

Ok - I have a same situation and I have done the below.

1) created a simple vb script with input file and output file as parameters.
2) LogFile Policy Monitor
a) Log File Name: Left Blank
b) Selected Preprocessing
i) File to be execured: <`cscript /nologo "C:\Documents and Settings\All Users\Application Data\HP\HP BTO Software\bin\instrumentation\PreProcessing.vbs" "D:\Logs\MultipleLines.log" "D:\Logs\SingleLine.log"`>
ii) D:\Logs\SingleLine.log
c) Polling Interval 15 s
d) Log File Characterset "ACP 1252"

When I deploy the instrumentation and the log file policy on the node - the follow event is generated in the event log and the policy is not capturing any events from the log file.

Computer: TEST
Source: HPOV-MAA
Category: None
Type: Error
Event ID: 1024
Description: Command '<`cscript /nologo "C:\Documents and Settings\All Users\Application Data\HP\HP BTO Software\bin\instrumentation\PreProcessing.vbs" "D:\Logs\MultipleLines.log" "D:\Logs\SingleLine.log"`>' configured in source 'Log_WithPreProcessing' returns 1.
Ignoring this logfile. (OpC30-107)

I executed the command on target host and it runs fine with no errors in the command prompt.

What am I missing?....
Any Help is greatly appreciated.

Anonymous said...

Hi Mahmoud

I was wondering if you would be having any such similar script for OMU 8.34 environment. I would like to monitor logfile for HP-UX node, looking for a shell or perl script.

Post a Comment