Thanks Roberth, Worked like a charm. Event Procedures seems like the only way to deal with the problem of having multiple log file watcher events that are not quite identical because of something like a time stamp. I had to create a new event with only the relevant sub-string. There should be an Event Condition for this but there is not.
On Wed, May 25, 2011 at 9:16 AM, <[email protected]> wrote: > Here you have one of my simulair working examples as reference. Keep up > the good work! > > /Roberth > > 0xfff00001 E 50 P "CreateEventWithAttributes( \ > { C CURRENT_MODEL }, \ > { H 0xfff00002 }, \ > SetEventAttribute( \ > SetEventAttribute( \ > SetEventAttribute( \ > SetEventAttribute( \ > SetEventAttribute( \ > GetEventAttributeList(), \ > { U 16 }, \ > GetRegexp( \ > GetEventAttribute( { U 4 } ), \ > { S \"(.*?)\/.*\" }, \ > { U 1 } \ > ) \ > ), \ > { U 142 }, \ > GetRegexp( \ > GetEventAttribute( { U 3 } ), \ > { S \".*monitorkeyid=(.*?) .*\" }, \ > { U 1 } \ > ) \ > ), \ > { U 145 }, \ > GetRegexp( \ > GetEventAttribute( { U 3 } ), \ > { S \".*severity=(.*)\" }, \ > { U 1 } \ > ) \ > ), \ > { U 144 }, \ > GetRegexp( \ > GetEventAttribute( { U 3 } ), \ > { S \"(.*?) monitor.*\" }, \ > { U 1 } \ > ) \ > ), \ > { U 143 }, \ > GetRegexp( \ > GetEventAttribute( { U 4 } ), \ > { S \".*\/(.*)\" }, \ > { U 1 } \ > ) \ > ) \ > )" > > > ------------------------------ > *Från:* Marty Davis [mailto:[email protected]] > *Skickat:* den 25 maj 2011 14:52 > *Till:* spectrum > *Ämne:* [spectrum] Event Procedures CreateEventWithVariables multiple > variables > > This is my first attempt at Event Procedures so bear with me if I am not > clear. > > > > I have been trying to create an event procedure that extracts a string from > an event, parses out three sub-strings from it, and creates a event > containing the three sub-strings as variables {S 101}, {S 102}, and {S 103}. > > > > I have tested the regex for all three successfully. I have no errors in > the event_disp_error_file. I get a new event 0xfff0000a created with only > one variable {S 101}. > > > > It looks to me that the CreateEventWithVariables syntax may be incorrect > (comma delimited string). > > > > I would be grateful for some help. > > > > String from 0xfff00003: “2011-05-25 12:36:24 W3SVC1 NYCB-EXCHANGE04 > 10.26.128.89 POST /Microsoft-Server-ActiveSync > Cmd=Ping&User=nycb%5c28657&DeviceId=MotoA0000022C3DBA4&DeviceType=MOTOBLUR30 > 443 nycb\28657 75.225.53.49 HTTP/1.1 Moto-Blur/3.0 webmail.mynycb.com 401 > 1 1326 296 501 15 ” > > > > 0xfff00003 P \ > > " CreateEventWithVariables ( \ > > { C CURRENT_MODEL }, \ > > { H 0xfff0000a }, \ > > SetEventVariable ( \ > > GetEventVariableList (), \ > > { U 101 }, \ > > GetRegexp ( \ > > GetEventVariable( { U 17 } ), \ > > { S \".*443 (.*?)([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+).* (HTTP.*?) > webmail\.mynycb\.com.*\" }, \ > > { U 1 } \ > > ) \ > > ), \ > > SetEventVariable ( \ > > GetEventVariableList (), \ > > { U 102 }, \ > > GetRegexp ( \ > > GetEventVariable( { U 17 } ), \ > > { S \".*443 (.*?)([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+).* (HTTP.*?) > webmail\.mynycb\.com.*\" }, \ > > { U 2 } \ > > ) \ > > ), \ > > SetEventVariable ( \ > > GetEventVariableList (), \ > > { U 103 }, \ > > GetRegexp ( \ > > GetEventVariable( { U 17 } ), \ > > { S \".*443 (.*?)([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+).* (HTTP.*?) > webmail\.mynycb\.com.*\" }, \ > > { U 3 } \ > > ) \ > > ) \ > > > -- > Marty Davis > > - --To unsubscribe from spectrum, send email to [email protected] with > the body: unsubscribe spectrum [email protected] > > -- Marty Davis -- Marty Davis --- To unsubscribe from spectrum, send email to [email protected] with the body: unsubscribe spectrum [email protected]
