Create Email Alert For Log Parser (Powershell and Perl)

Hi,
Need someone help on how i can make an email alert out of the Log Parser template. Currently, i can already make the log parser work. It detected the needed keyword i need. However, when i try to make an alert out of it, i can't find anything related in the "trigger condition' section.

Can someone help to direct me how i can make this alerting work? Which specific trigger condition i need to select to show these log parser related values?

Thanks,

Regards,

SGideon

Find more posts tagged with

sam

log parser

Accepted answers

vinay.by

To start with, I guess this is what you are looking for, fine tune it accordingly.

Email Action (user the below variables in Message Section)

Hope it helps.

All comments

sgideon

In addition, how can i put the exact message detected in the email alert? See the message i want to put in the email alert

vinay.by

To start with, I guess this is what you are looking for, fine tune it accordingly.

Email Action (user the below variables in Message Section)

Hope it helps.

sgideon

Hi Vinay,

Appreciate your help. It Works for me, only for the message part on the email,

i can't use the one below cause it always returns empty.

${N=SwisEntity;M=ComponentAlert.ComponentMessages}

I've found this variable that gives me the output i need.

${N=SwisEntity;M=ComponentAlert.MultiValueMessages}

Really appreciate your help.

Thanks and regards. Keep safe.

vinay.by

Ah alright now I get it, ok so ${N=SwisEntity;M=ComponentAlert.ComponentMessages} is not working because the component monitor in your case is retrieving multiple values, componentmessage will only work when a single value is captured as an output (to the best of my knowledge).

faizan_123

@sgideon Can you please let me know how did you got log parser to work, because when we are trying and testing on the log file it is showing me no error is generated. But we have manually inserted the error string and string was also present in the log. But could not understand what is going wrong, because all tests seems to be passing.

sgideon

hi faizan, apology for the late response. Are you still having this problem?

So you mean that your parser seems to be working but not picking up the keywords from the log file? however, when you try to test it against a certain file, does it catch the keywords you want? Can you share screenshots to understand better the problem?

faizan_123

Hi @sgideon, first we were facing issues with the linux parser script because of the service account limitations, now the problem is that we have around 10 log files on every server which we need to monitor that to with 2 different error strings.

What i did is that i created a template per node and added the linux script monitor according to the number of files with number or errors i need.

In my template only the first component is showing as up

when i am editing the failing component monitor and testing it again it is giving me correct answer

Below is the normal error which i am getting

The Script which i am using is mentioned below after my execution command

Command line : dzdo perl ${SCRIPT} "/u01/app/product/grid/diag/asm/+asm/+ASM1/trace/alert_+ASM1.log" "ORA-00600"

General script which i downloaded from Thwack.

use File::Basename;
$lp=$ARGV[0];
$regex=$ARGV[1];
$er_mes="Message: Check arguments: \"logfile_path\" \"regex\".";
$ws="Statistic:";
$wm="Message:";
$name = basename $lp;
sub chk_var
{
if ($_[0] eq '')
{
print "$er_mes\n";
exit 1;
}
}
sub out_res
{
print "Statistic: $_[0]\n";
print "Message: $_[1]\n";
exit 0;
}
chk_var($lp);
chk_var($regex);
unless (-e $lp)
{
print "$wm File $lp not found.\n";
exit 1;
}
$search=$regex;
$search=~ s/[^a-zA-Z0-9]*//g;
$fp='/tmp/new'.'_'.${name}.'_'.${search};
if (-e "$fp")
{
open (TF, $fp);
while (<TF>)
{
chomp;
$kr=$_;
}
close (TF);
}
else
{
$kr=0;
}
open (LF, $lp);
my @lf = <LF>;
close (LF);
$i=0;
$pos=1;
$t=0;
foreach $l (@lf)
{
chomp $l;
if ($l =~ /$regex/)
{
$resl[$i]=$l;
$resn[$i]=$pos;
$i++;
$t++;
}
$pos++;
}
if ($t lt $kr)
{
$kr=0;
}
$temp=$t-$kr;
$kr=$temp+$kr;
open (TF, ">$fp");
print TF "$kr\n";
close TF;
$length=@resl;
$limit=$length-1-$temp;
if ($temp ne 0)
{
for ($i=$length-1;$i>$limit;$i--)
{
$l=$resl[$i];
$str.="<br/>";
$str.=$l;
$str.=";";
}
print "$ws $temp\n";
print "$wm Number of newly found string: $temp. Lines that have search string: $str\n";
exit 0;
}
else
{
print "$ws $temp\n";
print "$wm No new strings found.\n";
exit 0;
}

All the help will be appreciated

sgideon

Hi faizan, no problem on the script. but based on the error it looks like related to script output configuration. can take a look this part of your configuration? make sure to define it properly.