Shell Programming and Scripting

Hello all,

I have a situation where I need to parse for certain items from a $VARIABLE within a sh script.
The line inside the sh script where this takes place is simply an echo:

echo "EventMessage: $EVENTMSG"

Is there a way to parse the $EVENTMSG by using RegEx? AND can I put the results of the RegEx as another variable WITHIN the same script?

The simple answer is "Yes." You can do all of that. But, to figure out what needs to be done here, we need to know a lot more about the format of the string referenced by $EVENTMSG and we need to know what you want out of $EVENTMSG besides the substring that follows AlarmSeverity=.

Thanks for your immediate response!!

To answer your question, the $EVENTMSG could look like some 40,000 different messages taken directly from 40,000 Event files.

There is one part in every single file that is the same... the time/day/date stamp, followed by "ModelType={t}, ModelName={m}"... but I may not necessarily need to parse that out.

The {t} and {m} are variables from another program that will input the appropriate data, so when it arrives in the $EVENTMSG it has usable data.

As far as "what I want out of the $EVENTMSG besides the substring that follows (AlarmSeverity=)", the short answer is, it depends on the script that I am using this in. In other words, I have a process in place that will send SPECIFIC alerts depending on a host of alert filters to the process that runs this sh script. The script, itself, is called SetScript.sh, and is called when the alert filters are passed. There is a separate SetScript for each type of alert filter that I create, so that means that what I need out of the $EVENTMSG will depend on the filter that it passes.

Not much of an answer, but that's what I have to work with

If you need any more details please let me know.

Thanks again Don~!!!

You're right. That doesn't give us much of an answer.

Please show us a few examples (using code tags) of actual event messages.
Then given those messages, tell us exactly what you want to get as a result of processing them. If what you want to get out of a message depends on a SetScript, tell us how to find the SetScript associated with an arbitrary message and show us relevant examples of SetScript contents.

This might get you started:

Code:

EVENTMSG="Wed 26 Sep, 2012
 ModelType= Event message testing
 ModelName= Alpha Test
 AlarmSeverity= Critical
 ActionEvent= Evacuate Immediately
 Payload= large raw data string"
 
SEV=$(echo "$EVENTMSG" | sed -nE 's/.+AlarmSeverity=\s(\S+)/\1/p')
echo $SEV

let me see if I can supply what you are asking for:

Here is a sample of an event message file:

Code:

{d "%w- %d %m-, %Y - %T"} - Device {m} of type {t} is no longer responding to requests.  This condition has persisted for more than 3 minutes.
 
Alert Code: {S 1}
Server Instance: {I 2}
Severity: {S 100}

Here is a sample of the same event message when I get it in the application with an alert that has been processed:

Code:

Sept 21, 2012 8:21:55 PM MDT - Device Main_Server_01 of type Host_Server is no longer responding to requests.  This condition has persisted for more than 3 minutes.
 
Alert Code: Danger
Server Instance: 31415
Severity: Critical

I am looking to get, as an example, the Server Instance value. The event file uses {I 2} which represents the 2nd varbind in the trap that is being sent, and the value is an Integer. I obviously don't care about the literal "{I 2}" portion, I am interested in the value that it is bringing back: 31415.

So in the SetScript it would look something like this:

Code:

# echo "EventMessage: $EVENTMSG"
echo "Server Instance Error: " $SI

where $SI is the value taken from the $EVENTMSG that I will hopefully be able to parse.

The solution I posted earlier should work for this data eg:

Code:

EVENTMSG="Sept 21, 2012 8:21:55 PM MDT - Device Main_Server_01 of type Host_Server is no longer responding to requests.  This condition has persisted for more than 3 minutes.
 
 Alert Code: Danger
 Server Instance: 31415
 Severity: Critical"
SI=$(echo "$EVENTMSG" | sed -nE 's/.+Server Instance:\s(\S+)/\1/p')
echo $SI

Output is:

Code:

31415

If you know extended regular expressions, and I suspect you do as you posted the above RE in your first post.
You should be able to tailor the sed command to fetch any value you are after.