Yes, you can do this, I have done it to count servers going OOM, with a rule to increment, decrement and one to check the total against a threshold. It is part of a larger framework, so you see for exmapolke a server start doing all sorts of things to events.


#rule to catch OOM and increment counter
type=single
ptype=perlfunc
continue=TAKENEXT
pattern=sub { if ($_[0] =~ /.*(java.lang.OutOfMemoryError).*/) { my($temp) = $1; \
return ($temp, $_[1] =~ m/.*\/(.*)\.SystemOut\.log$/);  } else { return 0; } }
context=!OOM_FOR_$2
desc=$0
action="" OOM reported on $2; eval %OOM_COUNT (++$OOM_COUNT);create OOM_FOR_$2; create CHECK_OOM_THRESHOLD; write %alertfile %t Error reported by Applic
ation: %app on Layer: %layer. Node: $2 reports: $1. Full error is: $0;assign %input "$0"; shellcmd %email_script %input %layer %app $2 %all_mailto

#rule to catch OOM at THRESHOLD and alert on it
type=single
ptype=perlfunc
pattern=sub { if ($_[0] =~ /.*(java.lang.OutOfMemoryError).*/) { my($temp) = $1; \
return ($temp, $_[1] =~ m/.*\/(.*)\.SystemOut\.log$/);  } else { return 0; } }
context==($OOM_COUNT>=$OOM_THRESHOLD)&&CHECK_OOM_THRESHOLD&&!OOM_THRESHOLD_EXCEEDED
desc=$0
action="" THRESHOLD Triggered! OOM_COUNT is: %OOM_COUNT and OOM_THRESHOLD is: %OOM_THRESHOLD; create OOM_THRESHOLD_EXCEEDED; delete CHECK_OOM_THRESHOLD



#rule to remove OOM event and decrement counter if a server is restarted - only fires if the OOM flag for the server is set.
type=single
ptype=perlfunc
continue=TAKENEXT
pattern=sub { if ($_[0] =~ /.*WSVR0001I: Server (.*) open for e-business$/) { my($temp) = $1; \
return ($temp, $_[1] =~ m/.*\/(.*)\.SystemOut\.log$/);  } else { return 0; } }
context=OOM_FOR_$2
desc=$0
action="" Server started: $2 - deleting OOM event and all state contexts; create STARTED_FOR_$2; delete HUNG_THREADS_FOR_$2; delete STOPPED_FOR_$2; dele
te STOPPING_FOR_$2; delete STARTING_FOR_$2; delete OOM_FOR_$2;eval %OOM_COUNT (--$OOM_COUNT); delete DYNACACHE_GRID_DOWN_FOR_$2; create DYNACACHE_GRID_UP_FOR
_$2


#rule to reset OOM_THRESHOLD_EXCEEDED once there is no OOM servers.
type=single
ptype=perlfunc
pattern=sub { if ($_[0] =~ /.*WSVR0001I: Server (.*) open for e-business$/) { my($temp) = $1; \
return ($temp, $_[1] =~ m/.*\/(.*)\.SystemOut\.log$/);  } else { return 0; } }
context==($OOM_COUNT==0)&&OOM_THRESHOLD_EXCEEDED
desc=$0
action="" OOM_THRESHOLD_EXCEEDED flag reset; delete OOM_THRESHOLD_EXCEEDED

John Grasett
Senior Technical Specialist, Consulting Services

Ascendant Technology, an Avnet Technology Solutions Company
Office: +44(0) 1905 760 950
Cell: +44 (0) 7557 567 470
[email protected]
www.atech.com
www.ats.avnet.com
------------------------------------------------------------------------------
Got visibility?
Most devs has no idea what their production app looks like.
Find out how fast your code is with AppDynamics Lite.
http://ad.doubleclick.net/clk;262219671;13503038;y?
http://info.appdynamics.com/FreeJavaPerformanceDownload.html
_______________________________________________
Simple-evcorr-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users

Reply via email to