Softpanorama (slightly skeptical) Open Source Software Educational Society

May the source be with you, but remember the KISS principle ;-) Softpanorama Search

Tivoli Logfile adapter format file

Creating the format file

The format file contains message format specifications and their mappings to BAROC events. The message fields of a record in the log file are matched against the format descriptions in this file and when a match succeeds, the corresponding Tivoli Enterprise Console^® event is generated by the adapter.

The default format files (Windows^®: tecad_win_C.fmt and Linux^®: tecad_logfile_C.fmt) contain predefined mappings for some common events for Windows and System logs for Linux. They can also be customized to add new messages.

You can create a customized format file for a specific log file. The following examples show sample entries from customized format file tecad_wassample_C.fmt used for the WebSphere^® Application Server SystemOut.log and sending events of classes to Tivoli Enterprise Console:

FORMAT WAS_Base 
[%s+] %s %s* 
hostname DEFAULT
fqhostname DEFAULT
origin DEFAULT
msg $3
-sysout $3
msg PRINTF("%s", sysout)
END

FORMAT WAS_INFO FOLLOWS WAS_Base
[%s+] %s %s I %s: %s*
-s1 $3
-s2 $4
-s3 $5
msg PRINTF("%s %s %s", s1, s2, s3)
severity "HARMLESS"
END

FORMAT WAS_INFO FOLLOWS WAS_Base
[%s+] %s %s A %s: %s*
-s1 $3
-s2 $4
-s3 $5
msg PRINTF("%s %s %s", s1, s2, s3)
severity "HARMLESS"
END

FORMAT WAS_WARNING FOLLOWS WAS_Base
[%s+] %s %s W %s: %s*
-s1 $3
-s2 $4
-s3 $5
msg PRINTF("%s %s %s", s1, s2, s3)
severity "WARNING"
END

FORMAT WAS_ERROR FOLLOWS WAS_Base
[%s+] %s %s E %s: %s*
-s1 $3
-s2 $4
-s3 $5
msg PRINTF("%s %s %s", s1, s2, s3)
severity "MINOR"
END

To use the sample format files for SystemOut.log (WebSphere Application Server), db2diag.log (DB2^®), and AMQERR01.log (WebSphere MQ), perform the following steps:

On your Tivoli Enterprise Console server, copy the necessary adapter format files to the appropriate directories. To do this, perform the following steps:

1. Upload the following files to the Tivoli Enterprise Console server from the following directories on CD 1:
   • logfilead\samples\tecad_wassample_C.fmt
   • logfilead\samples\tecad_db2v82sample_C.fmt
   • logfilead\samples\tecad_wmqsample_C.fmt
2. Copy the files to the ACF_REP directory under the TME^® installation directory. For example: /opt/Tivoli/bin/generic_unix/TME/ACF_REP
3. Follow the steps in the Defining event classes in a BAROC file section to create BAROC file that defines the necessary Tivoli Enterprise Console event classes.

Parent topic: Using log file adapters

A convenient way to get events into the Tivoli Enterprise Console from an application or resource is to use the existing Logfile Adapter. This is easier than writing a custom adapter.

• If the application or resource can write its event information into a flat ASCII logfile, the existing Logfile Adapter can be reconfigured to read that log and construct Tivoli Enterprise Console events.
• The Logfile Format Editor is used to construct a format file.
• The Logfile Adapter uses that format file to map log entry into a event.

Our goal is to be able to generate Tivoli Enterprise Console events from a new application or resource. There is an existing mechanism designed to read information from a logfile and generate messages that correspond to the log entries. This mechanism can be configured to work with other sources.

While this is the easiest way to hook up your application with Tivoli Enterprise Console, you can alternatively write your own event adapter.

Tivoli provides a Logfile Adapter for its UNIX platforms. It reports on the kinds of events monitored by syslogd in UNIX such as su failures, disk space exhaustion, and permissions problems. Syslogd puts this information into the log file specified in its /etc/syslog.conf file.

While the various varieties of UNIX all report similar information, the different varieties do not report it in exactly the same way. For this reason, Tivoli devised format files, which map logfile entries to BAROC event definitions. Using format files, each variety of UNIX can map its own log into the common BAROC definitions.

This mechanism turns out to be more generally useful. Tivoli allows you to point to your own log file and specify your own format. Then the existing Logfile Adapter does the work of creating the appropriate event.

The NT Event Adapter allows the same capability for the NT platforms.

So far in our labs, in order to generate an event we use the CLI command wpostemsg. We need to automatically generate events from their source. Continuing with our previous example, you can get your application to write its event information into a flat file, as shown in the following graphic.

The existing Logfile Adapter can then be used to generate events.

The goal of the Logfile Format Editor is to convert entries in a flat file to events. For example, your application writes something like the following graphic.

However, you want something to correspond to each line, as shown in the following graphic.

The Logfile Format Editor allows you to specify mappings. Use this input:

Jan 1 14:39:46 bebop PerfPlus: SwapOut 7340

If you want this mapping:

• Jan 1 14:39:46 is a timestamp ( %t ) that goes into the date attribute. This timestamp format is different than the format in the date_reception attribute.
• bebop is a string(%s) that goes to the hostname attribute.
• PerfPlus: is a required constant that identifies this source.
• SwapOut is a required constant that identifies event class.
• 7340 is a string. Second string goes to pid attribute.

The format statement is:

%t %s PerfPlus: SwapOut %s

Details (such as attribute assignments) will be explained later, but the critical point is that lines in the log file are compared against format statements until a match is found. When a match is found, the mapping from the ASCII text to a BAROC definition is made.

To invoke the Logfile Format Editor from the Edit Adapter dialog, click the Logfile Format Editor button.