The UNIX and Linux Forums

The UNIX and Linux Forums (http://www.unix.com/index.php)
-   Shell Programming and Scripting (http://www.unix.com/shell-programming-and-scripting/)
-   -   Scan log file for errors (http://www.unix.com/shell-programming-and-scripting/173208-scan-log-file-errors.html)

jimbojames 12-14-2011 04:54 PM

Scan log file for errors
 
Hi everyone.

I am still new to UNIX, and am having trouble figuring out how to create a script to scan a log file to look for errors based on a string.

We run AIX 5.3, and would like the ability to report all the instances of WebSphere Broker Execution groups crashing. This script would ideally exit with a status of 1 and list the Execution Group names that had crashed if an error was detected. This would then allow our scheduling tool to report the error back to the user.

An example of the error we would be scanning for is contained below:

Quote:

Oct 22 10:01:53 <server-name> user:warn|warning WebSphere Broker v60011[999480]: (BRK_MQCSPA01)[4370]BIP2060W: The broker has detected that the
Execution Group EXG_CS06, process ID 1048594, has shutdown. : BRK_MQCSPA01.agent: /build/S600_P/src/AdminAgent/ImbAdminAgent.cpp: 4296: ImbA
dminAgent::startAndMonitorADataFlowEngine: :
Any help with this would be greatly appreciated.

Chubler_XL 12-14-2011 05:38 PM

How about this
Code:

awk '/user:warn/ && /has shutdown/ {a=a","gensub(/.+\((.+)\).+/, "\\1",$0)}
END { if(a){ print substr(a,2); exit 2}}' log_file


jimbojames 12-14-2011 06:46 PM

Thanks Chubler_XL,

When I run your suggestion as a script:

Code:

#!/usr/bin/ksh

awk '/user:warn/ && /has shutdown/ {a=a","gensub(/.+\((.+)\).+/, "\\1",$0)}
END { if(a){ print substr(a,2); exit 2}}' /var/mqsi/logs/CS/hub/user.log

I am getting the following error:

Quote:

awk: Function gensub is not defined.

The input line number is 2. The file is /var/mqsi/logs/CS/hub/user.log.
The source line number is 1.
I believe that I have given the correct information for the log file, and do not understand what the issue is, would you have any suggesstions for me?

Chubler_XL 12-14-2011 11:08 PM

gensub is a GNU awk function, If you have gawk use that otherwise this vanila awk script should do it:
Code:

awk '/user:warn/ && /has shutdown/ {sub(/^.*\(/,"");sub(/\).*$/,"");a=a","$0 }
END { if(a){ print substr(a,2); exit 2}}' infile


jimbojames 12-15-2011 03:43 PM

Thank you Chubler_XL, that is working better now.

Instead of returning the Broker Queue manager name, is it possible to report the time and part of the string from the message?

Something along the lines of:

Quote:

Oct 22 10:01:53: The broker has detected that the Execution Group EXG_CS06, process ID 1048594, has shutdown.
?

Thanks again, I really appreciate your help.

vgersh99 12-15-2011 04:04 PM

Code:

awk '/user:warn/ && /has shutdown/ { match($0,"The broker[^.][^.]*[.]");print $1,$2,$3 ":", substr($0, RSTART,RLENGTH)}' myFile

jimbojames 12-15-2011 04:36 PM

Thank you vgersh99,

That is what I am looking for!

One last question though, is there a way to only return the errors from the date that the code is run on? (ie, run the code today (12/16/2011) only return errors reported since 0000hrs)


All times are GMT -4. The time now is 11:50 AM.

Linux and Unix Supported by: vBulletin
Search Engine Optimisation provided by DragonByte SEO v1.1.4 (Pro) - vBulletin Mods & Addons Copyright © 2014 DragonByte Technologies Ltd.
The UNIX and Linux Forums Content Copyright ©1993-2013. All Rights Reserved.
Forum Operations by The UNIX and Linux Forums