Hi
I have to deal with eventlogs containing entries like this:
** Event: 1240: 012 09:54:21 06.02 RB:Bat test fail 12999
Where we define the 1240 as sequence number.
I would like to extract the sequence number for further processing. Therefore I
decided to use 2 rules. One to store event "attributes" like the sequence
number (in fact I store the whole event text) as a context content (with the
add action):
# ------------------------------------------------------------- START OF RULE -
# rule 3: find RB:Bat test fail
# possible cause: Battery fuses in RB cabinet tripped
# advice: check RB battery fuses F...
type=single
desc=find a RB Mains Failure and create a triggering context
ptype=regexp
pattern=.*Event: 0*(\d+): 012 \d\d:\d\d:\d\d \d\d.\d\d .* 0*(\d+)
action=create trig_rb_bat_test_fail; \
add trig_rb_bat_test_fail $0
# --------------------------------------------------------------- END OF RULE -
In the second rule I use an eval action ....
# ------------------------------------------------------------- START OF RULE -
# rule selection
type=single
desc=RB:Bat test fail
ptype=regexp
pattern=le.*Event:.*
context=trig_rb_bat_test_fail
action=eval %o ( \
foreach $eventline (@{$val = \
$main::context_list{trig_rb_bat_test_fail}->{"Buffer"}}) {\
$eventline =~ /.*Event: 0*(\d+).*/; \
print "$1\n"; \
} \
)
# --------------------------------------------------------------- END OF RULE -
... to extract the sequence number. I assumed that the expression
$eventline =~ /.*Event: 0*(\d1).*/
Provides me the sequence number in $1. However the output is just:
1
Instead of 1240.
Any suggestions what I'am assuming or doing wrong?
Thnx and Kind regs.
Hans-Joerg
------------------------------------------------------------------------------
_______________________________________________
Simple-evcorr-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
