|
[TEC] more unix logfile adapter fun: msg#00499sysutils.tivoli.tme10
tec 3.9, fixpack 1 the adapter's guide Appendix B Format specifications section (page 188~189) tells me that I can truncate the length of a constant by using the printf-like %[length]s(+|*) structure ... I just tried it and it didn't work ... here's my format pattern: FORMAT PFI_Logfile %s+|%s|%99s+|%s|%s|%s|%s|%s|%s|%s|%s|%s* origin DEFAULT hostname DEFAULT severity MINOR sub_source PRINTF("hq.apps.pfi.%s.acp", hostname) msg_date $1 processMsgCode $2 description $3 criticality $4 application_id $5 subsys_id $6 component $7 interface $8 family $9 msg_type $10 obj_key_id $11 run_id $12 msg PRINTF("Application %s failure code %s at %s", interface, processMsgCode, msg_date) END in my previous discussion on the list, the description field ($3) was giving my trouble because it was a very long string with lots of embedded quotes ... so I am trying to simply snip off the first 99 characters because they contain some valuable data and the quotes don't start (usually) until well after character position 100 in that field. This format compiled without a problem & events are being generated, but when the event gets sent to TEC, the description field has not been truncated as expected .. it has the full 600+ characters with all the stoopid embedded quotes causing the event to fail parsing again. Has anybody had success using the character length restriction as indicated in the adapters guide? Or do you see any obvious mistakes I've made here? tia, John Guadagnino Gap Inc. |
|
| <Prev in Thread] | Current Thread | [Next in Thread> |
|---|---|---|
| Previous by Date: | RE: [TEC] event failed parsing ... why?: 00499, John Guadagnino |
|---|---|
| Next by Date: | Re: [TEC] more unix logfile adapter fun: 00499, Craig Lister |
| Previous by Thread: | Antwort: Re: Memo: RE: wadminep [ep_name] send_filei: 00499, lothar_schild-036LXszk8b4 |
| Next by Thread: | [TEC] more unix logfile adapter fun: 00499, Thomas Seeling |
| Indexes: | [Date] [Thread] [Top] [All Lists] |
| News | FAQ | advertise |