HELP I need help with returning a string when a keyword is found in a log (Unix and Windows)

familyofcrowes

I am currently in the process of removing Tivoli from our enterprise and replacing it with APM (we also have NPM, NTA, NCM, IPSLA, IPAM...).  Orion is doing a great job so far with the Windows systems.  Now that I am getting into the Unix systems (189 applications, over 2000 components, 280 production Unix servers) I find that logs are a REAL PAIN.  I do not know Unix or Perl.  After our layoffs we only have two Unix engineers left with minimal Perl experience.

 

My question is this, I use the keyword log template finds the keyword great and goes into a "down"state, but I need to send an alert to the "job owners" that states what job failed that the log is telling us about.  So I need it to return a value from the log.

Does anyone have any ideas?  My company just laid off 50% of our IT staff, so I have few resources here...

bobross

Since you already have a script that returns down if the keyword is found (I'm not able to find the template you are referring to at the moment, unfortunately) you should be able to modify the regex a bit or even use what is already found.

 

Perl's regex can make use of parentheses to populate some variables ($1, $2, $3) which are numbered based on the position of the left parens:

(1(2)(3)) - If this makes sense to you.

You'll likely have a statement that looks like this:

if (m/somepatternshowingdown/)
{
    print "Message: App is Down";
    print "Statistic: 0";
    exit(1);
}

You can use the parens to expand this out, assuming you know where the job name is located:

if (m/somepatternshowingdown - (.+)/)
{
    print "Message: App is Down - Job $1";
    print "Statistic: 0";
    exit(1);
}

 

Now whatever is captured by the .+ (one or more of any character) is now assigned to $1 and can be called for the value.

This is a pretty basic description of regex captures, but hopefully it will help push you in the right direction.  perlre has some good information on regex capture groups as well.  Might be worth it to have your Unix guys take a look.