Tivoli Logfile adapter format file

Creating the format file

The format file contains message format specifications and their mappings to BAROC events. The message fields of a record in the log file are matched against the format descriptions in this file and when a match succeeds, the corresponding Tivoli Enterprise Console^® event is generated by the adapter.

The default format files (Windows^®: tecad_win_C.fmt and Linux^®: tecad_logfile_C.fmt) contain predefined mappings for some common events for Windows and System logs for Linux. They can also be customized to add new messages.

You can create a customized format file for a specific log file. The following examples show sample entries from customized format file tecad_wassample_C.fmt used for the WebSphere^® Application Server SystemOut.log and sending events of classes to Tivoli Enterprise Console:

FORMAT WAS_Base 
[%s+] %s %s* 
hostname DEFAULT
fqhostname DEFAULT
origin DEFAULT
msg $3
-sysout $3
msg PRINTF("%s", sysout)
END

FORMAT WAS_INFO FOLLOWS WAS_Base
[%s+] %s %s I %s: %s*
-s1 $3
-s2 $4
-s3 $5
msg PRINTF("%s %s %s", s1, s2, s3)
severity "HARMLESS"
END

FORMAT WAS_INFO FOLLOWS WAS_Base
[%s+] %s %s A %s: %s*
-s1 $3
-s2 $4
-s3 $5
msg PRINTF("%s %s %s", s1, s2, s3)
severity "HARMLESS"
END

FORMAT WAS_WARNING FOLLOWS WAS_Base
[%s+] %s %s W %s: %s*
-s1 $3
-s2 $4
-s3 $5
msg PRINTF("%s %s %s", s1, s2, s3)
severity "WARNING"
END

FORMAT WAS_ERROR FOLLOWS WAS_Base
[%s+] %s %s E %s: %s*
-s1 $3
-s2 $4
-s3 $5
msg PRINTF("%s %s %s", s1, s2, s3)
severity "MINOR"
END

To use the sample format files for SystemOut.log (WebSphere Application Server), db2diag.log (DB2^®), and AMQERR01.log (WebSphere MQ), perform the following steps:

On your Tivoli Enterprise Console server, copy the necessary adapter format files to the appropriate directories. To do this, perform the following steps:

1. Upload the following files to the Tivoli Enterprise Console server from the following directories on CD 1:
   • logfilead\samples\tecad_wassample_C.fmt
   • logfilead\samples\tecad_db2v82sample_C.fmt
   • logfilead\samples\tecad_wmqsample_C.fmt
2. Copy the files to the ACF_REP directory under the TME^® installation directory. For example: /opt/Tivoli/bin/generic_unix/TME/ACF_REP
3. Follow the steps in the Defining event classes in a BAROC file section to create BAROC file that defines the necessary Tivoli Enterprise Console event classes.

Parent topic: Using log file adapters

A convenient way to get events into the Tivoli Enterprise Console from an application or resource is to use the existing Logfile Adapter. This is easier than writing a custom adapter.

• If the application or resource can write its event information into a flat ASCII logfile, the existing Logfile Adapter can be reconfigured to read that log and construct Tivoli Enterprise Console events.
• The Logfile Format Editor is used to construct a format file.
• The Logfile Adapter uses that format file to map log entry into a event.

Our goal is to be able to generate Tivoli Enterprise Console events from a new application or resource. There is an existing mechanism designed to read information from a logfile and generate messages that correspond to the log entries. This mechanism can be configured to work with other sources.

While this is the easiest way to hook up your application with Tivoli Enterprise Console, you can alternatively write your own event adapter.

Tivoli provides a Logfile Adapter for its UNIX platforms. It reports on the kinds of events monitored by syslogd in UNIX such as su failures, disk space exhaustion, and permissions problems. Syslogd puts this information into the log file specified in its /etc/syslog.conf file.

While the various varieties of UNIX all report similar information, the different varieties do not report it in exactly the same way. For this reason, Tivoli devised format files, which map logfile entries to BAROC event definitions. Using format files, each variety of UNIX can map its own log into the common BAROC definitions.

This mechanism turns out to be more generally useful. Tivoli allows you to point to your own log file and specify your own format. Then the existing Logfile Adapter does the work of creating the appropriate event.

The NT Event Adapter allows the same capability for the NT platforms.

So far in our labs, in order to generate an event we use the CLI command wpostemsg. We need to automatically generate events from their source. Continuing with our previous example, you can get your application to write its event information into a flat file, as shown in the following graphic.

The existing Logfile Adapter can then be used to generate events.

The goal of the Logfile Format Editor is to convert entries in a flat file to events. For example, your application writes something like the following graphic.

However, you want something to correspond to each line, as shown in the following graphic.

The Logfile Format Editor allows you to specify mappings. Use this input:

Jan 1 14:39:46 bebop PerfPlus: SwapOut 7340

If you want this mapping:

• Jan 1 14:39:46 is a timestamp ( %t ) that goes into the date attribute. This timestamp format is different than the format in the date_reception attribute.
• bebop is a string(%s) that goes to the hostname attribute.
• PerfPlus: is a required constant that identifies this source.
• SwapOut is a required constant that identifies event class.
• 7340 is a string. Second string goes to pid attribute.

The format statement is:

%t %s PerfPlus: SwapOut %s

Details (such as attribute assignments) will be explained later, but the critical point is that lines in the log file are compared against format statements until a match is found. When a match is found, the mapping from the ASCII text to a BAROC definition is made.

To invoke the Logfile Format Editor from the Edit Adapter dialog, click the Logfile Format Editor button.

Etc

Society

Groupthink : Two Party System as Polyarchy : Corruption of Regulators : Bureaucracies : Understanding Micromanagers and Control Freaks : Toxic Managers :   Harvard Mafia : Diplomatic Communication : Surviving a Bad Performance Review : Insufficient Retirement Funds as Immanent Problem of Neoliberal Regime : PseudoScience : Who Rules America : Neoliberalism  : The Iron Law of Oligarchy : Libertarian Philosophy

Quotes

War and Peace : Skeptical Finance : John Kenneth Galbraith :Talleyrand : Oscar Wilde : Otto Von Bismarck : Keynes : George Carlin : Skeptics : Propaganda  : SE quotes : Language Design and Programming Quotes : Random IT-related quotes :  Somerset Maugham : Marcus Aurelius : Kurt Vonnegut : Eric Hoffer : Winston Churchill : Napoleon Bonaparte : Ambrose Bierce :  Bernard Shaw : Mark Twain Quotes

Bulletin:

Vol 25, No.12 (December, 2013) Rational Fools vs. Efficient Crooks The efficient markets hypothesis : Political Skeptic Bulletin, 2013 : Unemployment Bulletin, 2010 :  Vol 23, No.10 (October, 2011) An observation about corporate security departments : Slightly Skeptical Euromaydan Chronicles, June 2014 : Greenspan legacy bulletin, 2008 : Vol 25, No.10 (October, 2013) Cryptolocker Trojan (Win32/Crilock.A) : Vol 25, No.08 (August, 2013) Cloud providers as intelligence collection hubs : Financial Humor Bulletin, 2010 : Inequality Bulletin, 2009 : Financial Humor Bulletin, 2008 : Copyleft Problems Bulletin, 2004 : Financial Humor Bulletin, 2011 : Energy Bulletin, 2010 : Malware Protection Bulletin, 2010 : Vol 26, No.1 (January, 2013) Object-Oriented Cult : Political Skeptic Bulletin, 2011 : Vol 23, No.11 (November, 2011) Softpanorama classification of sysadmin horror stories : Vol 25, No.05 (May, 2013) Corporate bullshit as a communication method  : Vol 25, No.06 (June, 2013) A Note on the Relationship of Brooks Law and Conway Law

History:

Fifty glorious years (1950-2000): the triumph of the US computer engineering : Donald Knuth : TAoCP and its Influence of Computer Science : Richard Stallman : Linus Torvalds  : Larry Wall  : John K. Ousterhout : CTSS : Multix OS Unix History : Unix shell history : VI editor : History of pipes concept : Solaris : MS DOS :  Programming Languages History : PL/1 : Simula 67 : C : History of GCC development :  Scripting Languages : Perl history   : OS History : Mail : DNS : SSH : CPU Instruction Sets : SPARC systems 1987-2006 : Norton Commander : Norton Utilities : Norton Ghost : Frontpage history : Malware Defense History : GNU Screen : OSS early history

Classic books:

The Peter Principle : Parkinson Law : 1984 : The Mythical Man-Month :  How to Solve It by George Polya : The Art of Computer Programming : The Elements of Programming Style : The Unix Hater’s Handbook : The Jargon file : The True Believer : Programming Pearls : The Good Soldier Svejk : The Power Elite

Most popular humor pages:

Manifest of the Softpanorama IT Slacker Society : Ten Commandments of the IT Slackers Society : Computer Humor Collection : BSD Logo Story : The Cuckoo's Egg : IT Slang : C++ Humor : ARE YOU A BBS ADDICT? : The Perl Purity Test : Object oriented programmers of all nations : Financial Humor : Financial Humor Bulletin, 2008 : Financial Humor Bulletin, 2010 : The Most Comprehensive Collection of Editor-related Humor : Programming Language Humor : Goldman Sachs related humor : Greenspan humor : C Humor : Scripting Humor : Real Programmers Humor : Web Humor : GPL-related Humor : OFM Humor : Politically Incorrect Humor : IDS Humor : "Linux Sucks" Humor : Russian Musical Humor : Best Russian Programmer Humor : Microsoft plans to buy Catholic Church : Richard Stallman Related Humor : Admin Humor : Perl-related Humor : Linus Torvalds Related humor : PseudoScience Related Humor : Networking Humor : Shell Humor : Financial Humor Bulletin, 2011 : Financial Humor Bulletin, 2012 : Financial Humor Bulletin, 2013 : Java Humor : Software Engineering Humor : Sun Solaris Related Humor : Education Humor : IBM Humor : Assembler-related Humor : VIM Humor : Computer Viruses Humor : Bright tomorrow is rescheduled to a day after tomorrow : Classic Computer Humor

The Last but not Least Technology is dominated by two types of people: those who understand what they do not manage and those who manage what they do not understand ~Archibald Putt. Ph.D

The statements, views and opinions presented on this web page are those of the author (or referenced source) and are not endorsed by, nor do they necessarily reflect, the opinions of the Softpanorama society. We do not warrant the correctness of the information provided or its fitness for any purpose. The site uses AdSense so you need to be aware of Google privacy policy. You you do not want to be tracked by Google please disable Javascript for this site. This site is perfectly usable without Javascript.

Last modified: March 12, 2019