Maybe it would be easier if I started from the beginning... I think I may have confused the issue big time.

There is a directory on my server that has 40K+ files in it. If you opened up the folder where these files are located you would see something like this:

Code:

Event00a3ff01
Event00a3ff02
Event00a3ff03
etc. etc. etc.

As you can see, every event file name starts with "Event".

The reason why there are so many event files is that our application supports 100's of manufactures in managing their devices. Each device is loaded with their manufacture's "smarts" in their firmware. An example would be a Cisco 3750 switch or an IBM BladeCenter HS22 or the 100's of others that we are managing. As you can imagine, each device sends its own type of device messages (sometimes they are in "traps" and other times they are as a result of a "polled" attribute from the management system). For every type of device message and for every type of device manufacturer I have an Event file.

Here is an example of text that is found in the event file named Event01169b15 (note: this is the raw file this is used for incoming traps for this device and alert type)

Code:

{d "%w- %d %m-, %Y - %T"} - An "iddmodAgentDownTrap" event has occurred, from a device designated as type: {t}, named: {m}. 
 
This trap is sent when an Insight agent is detected to be down. It is then resent synchronously with the Alarm traps, every 5 minutes (default frequency) as long as the Insight agent is still detected to be down. 
 
Agent Name = {S 1} 
Agent Type = {S 3} 
Agent Status = {T iddmodAlarmSummaryUpDown 4}

NOTE:
{S 1} means the String from Varbind #1 in the trap,
{S 3} means the String from the Varbind #3 in the trap,
{T iddmodAlarmSummaryUpDown 4} means it is looking up a Table named "iddmodAlarmSummaryUpDown" for its information.

When the device, in this example, an IBM Director Host, sends a trap that matches this event message the information we get within our application looks like this:

Code:

Sep 28, 2012 7:43:57 AM MDT
 
- An "iddmodAgentDownTrap" event has occurred, from a device designated as type Host_IBMDirector, named lpvd-sqldv01.c.utah.com.
 
This trap is sent when an Insight agent is detected to be down. It is then resent synchronously with the Alarm traps, every 5 minutes (default frequency) as long as the Insight agent is still detected to be down.
 
Agent Name = ms2008-default@lpvd-sqldv01
Agent Type = ms2005
Agent Status = down

Here's another example of another event. This event is named Event00011223 and the raw file looks like this:

Code:

{d "%w- %d %m-, %Y - %T"} - A "LiveHealthAlarm" event has occurred, from {t} device, named {m}. 
 
eHealth Alarm Start Time - {D 2} 
eHealth Alarm Occurrence - {I 10} 
Element Name - {S 11} 
Element Alias - {S 14} 
Profile - {S 7} 
Exception Type - {S 4} 
Description - {S 76620} 
eHealth Alarm ID - {I 6}

NOTE:
{D 2} means a DateStamp in VarBind #2 from the trap.
{I 10} means in Integer in VarBind #10 from the trap.
{S 11} means a String in VarBind #11 from the trap.
etc.

And here is what an actual alert looks like from a device that matches the criteria set up to use this event message:

Code:

Sep 27,2012 09:03:08 PM - A "LiveHealthAlarm" event has occurred, from SwCiscoIOS device, named co-lpvi-6509-Q67-1.c.utah.com.
 
eHealth Alarm Start Time - Sep 27,2012 09:03:08 PM
eHealth Alarm Occurrence - 305954
Element Name - co-lpvi-6509-Q67-1.c.utah.com-RH
Element Alias - co-lpvi-6509-Q67-1.c.utah.com-RH
Profile - _Router or Switch - Failure
Exception Type - basicEvent
Description - Generic Syslog message
eHealth Alarm ID - 1000042

As you can see from these two examples, the event file does not have a set standard for its format because we are dealing with different manufacturers that do things differently.

I don't need to have a script that would take into account every single permuatation of the 40k+ event files.... rather I am interested in understanding the logic to create a script for each event type that I am insterested in parsing out additional information. So I would have a script for Event01169b15 and a separate script for Event00011223. Although the Events would be different, as far as the text goes, the logic I would think would be very similar.

In the first example, (assuming this is an event that I am going to use in another application that uses the SetScript) the portion of my SetScript that deals with the actual EventMessage, it might look something like this:

Code:

...
blah blah blah....
AN=(echo "$EVENTMSG" | sed -nE 's/.*Agent\sName\s=\s(\S+)/\1/p')
AT=(echo "$EVENTMSG" | sed -nE 's/.*Agent\sType\s=\s(\S+)/\1/p')
echo "The IBM Agent that needs to be rebuilt is: " $AN
echo "The Agent Type is: " $AT
...
blah blah blah....

NOTE: I got the sed command from another post. I'm wondering if it would work?

For the other example, another SetScript, renamed to LiveHealthSetScript, would look something like this:

Code:

...
blah blah blah....
EN=(echo "$EVENTMSG" | sed -nE 's/.*Element\sName\s-\s(\S+)/\1/p')
PF=(echo "$EVENTMSG" | sed -nE 's/.*Profile\s-\s(\S+)/\1/p')
AID=(echo "$EVENTMSG" | sed -nE 's/.*Alarm\sID\s-\s(\S+)/\1/p')
echo "The eH Element Name processed is: " $EN
echo "The eH Profile used is: " $PF
echo "The eH Alarm ID was: " $AID
...
blah blah blah....

So, you see, even though I am using different event files I am using them the same way, that is, I am parsing the $EVENTMSG for the things I need on a case by case basis.

Is this what you were looking for?

And, at the risk of sounding like a broken record, THANKS!!!!!