Scan log file for errors | Unix Linux Forums | Shell Programming and Scripting

  Go Back    


Shell Programming and Scripting Post questions about KSH, CSH, SH, BASH, PERL, PHP, SED, AWK and OTHER shell scripts and shell scripting languages here.

Scan log file for errors

Shell Programming and Scripting


Tags
.ksh, aix 5.3, error, monitor, script

Closed Thread    
 
Thread Tools Search this Thread Display Modes
    #1  
Old 12-14-2011
jimbojames jimbojames is offline
Registered User
 
Join Date: May 2011
Last Activity: 28 April 2014, 11:52 PM EDT
Posts: 47
Thanks: 12
Thanked 0 Times in 0 Posts
Scan log file for errors

Hi everyone.

I am still new to UNIX, and am having trouble figuring out how to create a script to scan a log file to look for errors based on a string.

We run AIX 5.3, and would like the ability to report all the instances of WebSphere Broker Execution groups crashing. This script would ideally exit with a status of 1 and list the Execution Group names that had crashed if an error was detected. This would then allow our scheduling tool to report the error back to the user.

An example of the error we would be scanning for is contained below:

Quote:
Oct 22 10:01:53 <server-name> user:warn|warning WebSphere Broker v60011[999480]: (BRK_MQCSPA01)[4370]BIP2060W: The broker has detected that the
Execution Group EXG_CS06, process ID 1048594, has shutdown. : BRK_MQCSPA01.agent: /build/S600_P/src/AdminAgent/ImbAdminAgent.cpp: 4296: ImbA
dminAgent::startAndMonitorADataFlowEngine: :
Any help with this would be greatly appreciated.
Sponsored Links
    #2  
Old 12-14-2011
Chubler_XL's Avatar
Chubler_XL Chubler_XL is offline Forum Advisor  
Registered User
 
Join Date: Oct 2010
Last Activity: 2 September 2014, 12:22 AM EDT
Posts: 2,821
Thanks: 106
Thanked 885 Times in 828 Posts
How about this

Code:
awk '/user:warn/ && /has shutdown/ {a=a","gensub(/.+\((.+)\).+/, "\\1",$0)}
END { if(a){ print substr(a,2); exit 2}}' log_file


Last edited by Chubler_XL; 12-14-2011 at 06:06 PM..
Sponsored Links
    #3  
Old 12-14-2011
jimbojames jimbojames is offline
Registered User
 
Join Date: May 2011
Last Activity: 28 April 2014, 11:52 PM EDT
Posts: 47
Thanks: 12
Thanked 0 Times in 0 Posts
Thanks Chubler_XL,

When I run your suggestion as a script:


Code:
#!/usr/bin/ksh

awk '/user:warn/ && /has shutdown/ {a=a","gensub(/.+\((.+)\).+/, "\\1",$0)}
END { if(a){ print substr(a,2); exit 2}}' /var/mqsi/logs/CS/hub/user.log

I am getting the following error:

Quote:
awk: Function gensub is not defined.

The input line number is 2. The file is /var/mqsi/logs/CS/hub/user.log.
The source line number is 1.
I believe that I have given the correct information for the log file, and do not understand what the issue is, would you have any suggesstions for me?
    #4  
Old 12-14-2011
Chubler_XL's Avatar
Chubler_XL Chubler_XL is offline Forum Advisor  
Registered User
 
Join Date: Oct 2010
Last Activity: 2 September 2014, 12:22 AM EDT
Posts: 2,821
Thanks: 106
Thanked 885 Times in 828 Posts
gensub is a GNU awk function, If you have gawk use that otherwise this vanila awk script should do it:

Code:
awk '/user:warn/ && /has shutdown/ {sub(/^.*\(/,"");sub(/\).*$/,"");a=a","$0 }
END { if(a){ print substr(a,2); exit 2}}' infile

Sponsored Links
    #5  
Old 12-15-2011
jimbojames jimbojames is offline
Registered User
 
Join Date: May 2011
Last Activity: 28 April 2014, 11:52 PM EDT
Posts: 47
Thanks: 12
Thanked 0 Times in 0 Posts
Thank you Chubler_XL, that is working better now.

Instead of returning the Broker Queue manager name, is it possible to report the time and part of the string from the message?

Something along the lines of:

Quote:
Oct 22 10:01:53: The broker has detected that the Execution Group EXG_CS06, process ID 1048594, has shutdown.
?

Thanks again, I really appreciate your help.
Sponsored Links
    #6  
Old 12-15-2011
vgersh99's Avatar
vgersh99 vgersh99 is offline Forum Advisor  
Forum Advisor
 
Join Date: Feb 2005
Last Activity: 2 September 2014, 12:07 AM EDT
Location: Foxborough, MA
Posts: 7,644
Thanks: 150
Thanked 577 Times in 542 Posts

Code:
awk '/user:warn/ && /has shutdown/ { match($0,"The broker[^.][^.]*[.]");print $1,$2,$3 ":", substr($0, RSTART,RLENGTH)}' myFile

Sponsored Links
    #7  
Old 12-15-2011
jimbojames jimbojames is offline
Registered User
 
Join Date: May 2011
Last Activity: 28 April 2014, 11:52 PM EDT
Posts: 47
Thanks: 12
Thanked 0 Times in 0 Posts
Thank you vgersh99,

That is what I am looking for!

One last question though, is there a way to only return the errors from the date that the code is run on? (ie, run the code today (12/16/2011) only return errors reported since 0000hrs)
Sponsored Links
Closed Thread

Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes

More UNIX and Linux Forum Topics You Might Find Helpful
Thread Thread Starter Forum Replies Last Post
Log File Scan mode09 Shell Programming and Scripting 2 04-01-2010 12:22 PM
Scan a log file nhanda Shell Programming and Scripting 3 01-19-2009 08:19 PM
File Inventory Scan seacros Shell Programming and Scripting 4 03-17-2008 11:13 AM
File Scan Dastard Shell Programming and Scripting 2 04-08-2007 03:35 PM
How to scan only new lines added in file? redlotus72 UNIX for Dummies Questions & Answers 3 04-28-2005 03:34 PM



All times are GMT -4. The time now is 05:10 AM.