In message <[EMAIL PROTECTED]>,
Tim Peiffer writes:
>I am trying to process queue event logs for service latency and running
>into 'Error evaluating code' that I can't seem fix. The context=
>=(miniprogram) is supposed to evaluate as true/false, right? Is there
>a better way?
>
>The sample shows a timestamp labelled queue file being processed at a
>given time. I am trying to track the difference between when the file
>was created and when it was processed, and then alert when that latency,
>typically 45 second, grows larger than 5 minutes.
Look at the evaluated statement and the error:
> Sat May 31 19:09:40 2008: Error evaluating code '(20080531 == 20080531)
> && ((19*3600+09*60+40)-(19*3600+09*60+30) >= 300)'
^^ ^^
> Illegal octal digit '9' at (eval 10) line 1, at end of line
The term "09" != "9" for perl. A leading 0 implies an octal constant
IIRC and 9 is not a valid octal number. Annoying. Maybe try matching
$8 with
0?(\d+)
so the leading 0 isn't incorporated in the subpattern match? I wonder
if quoting the replacement strings may work too so the context becomes:
... "09"*60 ...
which may become 9*60 in the string to number conversion. This would
be a problem for all your time fields I think.
>sec.cfg:
>#
># Look for high latency in processing
># Sample: mactrack-gath-1 MACdatabase.pl (1): Processed
>NET.20080531.08:50:50 at [EMAIL PROTECTED]:50:56 TUARN = (224/145/6/143/5351)
>#pattern=(\S+) MACdatabase.pl \S+ Processed NET.(\d+)\.(\d+):(\d+):(\d+)
>at (\d+)\@(\d+):(\d+):(\d+) TUARN = \(\d+\/\d+\/\d+\/\d+\/(\d+)\)
># $1 $2 $3 $4
>$5 $6 $7 $8 $9
>type=Single
>continue=takenext
>ptype=regexp
>pattern=(\S+) MACdatabase.pl \S+ Processed NET.(\d+)\.(\d+):(\d+):(\d+)
>at (\d+)\@(\d+):(\d+):(\d+) TUARN = \(\d+\/\d+\/\d+\/\d+\/(\d+)\)
>desc=$1 High Service Latency
>context= =(($2 == $6) && (($7*3600+$8*60+$9)-($3*3600+$4*60+$5) >= 300))
>action = logonly - %s $2 $3:$4:$5 $6 $7:$8:$9 greater than 300 seconds
--
-- rouilj
John Rouillard
===========================================================================
My employers don't acknowledge my existence much less my opinions.
-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Simple-evcorr-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
