Scan log file for errors | Unix Linux Forums | Shell Programming and Scripting

  Unix/Linux Go Back    


Shell Programming and Scripting Post questions about KSH, CSH, SH, BASH, PERL, PHP, SED, AWK and OTHER shell scripts and shell scripting languages here.

Scan log file for errors

Shell Programming and Scripting


Tags
.ksh, aix 5.3, error, monitor, script

Closed Linux or Unix Question    
 
Thread Tools Search this Thread Display Modes
    #1  
Old Unix and Linux 12-14-2011
jimbojames jimbojames is offline
Registered User
 
Join Date: May 2011
Last Activity: 28 April 2014, 11:52 PM EDT
Posts: 47
Thanks: 12
Thanked 0 Times in 0 Posts
Scan log file for errors

Hi everyone.

I am still new to UNIX, and am having trouble figuring out how to create a script to scan a log file to look for errors based on a string.

We run AIX 5.3, and would like the ability to report all the instances of WebSphere Broker Execution groups crashing. This script would ideally exit with a status of 1 and list the Execution Group names that had crashed if an error was detected. This would then allow our scheduling tool to report the error back to the user.

An example of the error we would be scanning for is contained below:

Quote:
Oct 22 10:01:53 <server-name> user:warn|warning WebSphere Broker v60011[999480]: (BRK_MQCSPA01)[4370]BIP2060W: The broker has detected that the
Execution Group EXG_CS06, process ID 1048594, has shutdown. : BRK_MQCSPA01.agent: /build/S600_P/src/AdminAgent/ImbAdminAgent.cpp: 4296: ImbA
dminAgent::startAndMonitorADataFlowEngine: :
Any help with this would be greatly appreciated.
Sponsored Links
    #2  
Old Unix and Linux 12-14-2011
Chubler_XL's Unix or Linux Image
Chubler_XL Chubler_XL is offline Forum Staff  
Moderator
 
Join Date: Oct 2010
Last Activity: 22 February 2015, 9:28 PM EST
Posts: 3,104
Thanks: 119
Thanked 1,008 Times in 945 Posts
How about this

Code:
awk '/user:warn/ && /has shutdown/ {a=a","gensub(/.+\((.+)\).+/, "\\1",$0)}
END { if(a){ print substr(a,2); exit 2}}' log_file


Last edited by Chubler_XL; 12-14-2011 at 07:06 PM..
Sponsored Links
    #3  
Old Unix and Linux 12-14-2011
jimbojames jimbojames is offline
Registered User
 
Join Date: May 2011
Last Activity: 28 April 2014, 11:52 PM EDT
Posts: 47
Thanks: 12
Thanked 0 Times in 0 Posts
Thanks Chubler_XL,

When I run your suggestion as a script:


Code:
#!/usr/bin/ksh

awk '/user:warn/ && /has shutdown/ {a=a","gensub(/.+\((.+)\).+/, "\\1",$0)}
END { if(a){ print substr(a,2); exit 2}}' /var/mqsi/logs/CS/hub/user.log

I am getting the following error:

Quote:
awk: Function gensub is not defined.

The input line number is 2. The file is /var/mqsi/logs/CS/hub/user.log.
The source line number is 1.
I believe that I have given the correct information for the log file, and do not understand what the issue is, would you have any suggesstions for me?
    #4  
Old Unix and Linux 12-15-2011
Chubler_XL's Unix or Linux Image
Chubler_XL Chubler_XL is offline Forum Staff  
Moderator
 
Join Date: Oct 2010
Last Activity: 22 February 2015, 9:28 PM EST
Posts: 3,104
Thanks: 119
Thanked 1,008 Times in 945 Posts
gensub is a GNU awk function, If you have gawk use that otherwise this vanila awk script should do it:

Code:
awk '/user:warn/ && /has shutdown/ {sub(/^.*\(/,"");sub(/\).*$/,"");a=a","$0 }
END { if(a){ print substr(a,2); exit 2}}' infile

Sponsored Links
    #5  
Old Unix and Linux 12-15-2011
jimbojames jimbojames is offline
Registered User
 
Join Date: May 2011
Last Activity: 28 April 2014, 11:52 PM EDT
Posts: 47
Thanks: 12
Thanked 0 Times in 0 Posts
Thank you Chubler_XL, that is working better now.

Instead of returning the Broker Queue manager name, is it possible to report the time and part of the string from the message?

Something along the lines of:

Quote:
Oct 22 10:01:53: The broker has detected that the Execution Group EXG_CS06, process ID 1048594, has shutdown.
?

Thanks again, I really appreciate your help.
Sponsored Links
    #6  
Old Unix and Linux 12-15-2011
vgersh99's Unix or Linux Image
vgersh99 vgersh99 is online now Forum Advisor  
Forum Advisor
 
Join Date: Feb 2005
Last Activity: 5 March 2015, 6:46 PM EST
Location: Foxborough, MA
Posts: 7,721
Thanks: 164
Thanked 612 Times in 573 Posts

Code:
awk '/user:warn/ && /has shutdown/ { match($0,"The broker[^.][^.]*[.]");print $1,$2,$3 ":", substr($0, RSTART,RLENGTH)}' myFile

Sponsored Links
    #7  
Old Unix and Linux 12-15-2011
jimbojames jimbojames is offline
Registered User
 
Join Date: May 2011
Last Activity: 28 April 2014, 11:52 PM EDT
Posts: 47
Thanks: 12
Thanked 0 Times in 0 Posts
Thank you vgersh99,

That is what I am looking for!

One last question though, is there a way to only return the errors from the date that the code is run on? (ie, run the code today (12/16/2011) only return errors reported since 0000hrs)
Sponsored Links
Closed Linux or Unix Question

Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes

Unix or Linux Image More UNIX and Linux Forum Topics You Might Find Helpful
Thread Thread Starter Forum Replies Last Post
Log File Scan mode09 Shell Programming and Scripting 2 04-01-2010 01:22 PM
Scan a log file nhanda Shell Programming and Scripting 3 01-19-2009 09:19 PM
File Inventory Scan seacros Shell Programming and Scripting 4 03-17-2008 12:13 PM
File Scan Dastard Shell Programming and Scripting 2 04-08-2007 04:35 PM
How to scan only new lines added in file? redlotus72 UNIX for Dummies Questions & Answers 3 04-28-2005 04:34 PM



All times are GMT -4. The time now is 08:00 PM.