I had seen so many questions about joining multiline log as in OMW the Log Interceptor is parsing line by line, so if your data is scattered on different lines it can not be monitoring unless you imply a pre-processing script.
I have created the below script is to join multiple lines together but if match a certain keyword
If Wscript.Arguments.Count < 2 Then
wscript.echo "Usage cscript joinlines.vbs ""logfilepath"" ""machingtext"" "
wscript.echo "Ex:"
wscript.echo "cscript joinlines.vbs ""d:logsfilename.log"" logfilename "
Else
Set args = WScript.Arguments
arg1 = WScript.Arguments.Item(0)
match = WScript.Arguments.Item(1)
Set fsObject = CreateObject("Scripting.FileSystemObject")
nodesFile = arg1
Set file = fsObject.GetFile(nodesFile)
Set line = file.OpenAsTextStream(1,TristateUseDefault)
dim arrFileLines()
Do Until line.AtEndOfStream
Redim Preserve arrFileLines(l)
arrFileLines(l) = line.ReadLine
l = l + 1
Loop
For l = Ubound(arrFileLines) to LBound(arrFileLines) Step -1
If Instr(arrFileLines(l), match) > 0 then
wscript.echo "maching line " & arrFileLines(l-1) &" " & arrFileLines(l)
end if
Next
End if
Save the contents to joinlines.vbs
It can be implemented in different ways:
You can create a log file policy to search for your error message in each line as the sample below
20110326 08:00:13 expdp_SHARED_DATASTAGE.sql started ok
20110326 08:14:13 expdp_SHARED_DATASTAGE.sql completed ok with this output:
The job "EXPDP_USER". "SYS_EXPORT_SCHEMA_06" failed at 08:15:00: ERROR
20110327 08:00:13 expdp_SHARED_DATASTAGE2.sql started ok
20110327 08:14:13 expdp_SHARED_DATASTAGE2.sql completed ok with this output:
The job "EXPDP_USER2". "SYS_EXPORT_SCHEMA_02" failed at 08:15:00: ERROR
20110328 08:00:13 expdp_SHARED_DATASTAGE3.sql started ok
20110328 08:14:13 expdp_SHARED_DATASTAGE3.sql completed ok with this output:
The job "EXPDP_USER2". "SYS_EXPORT_SCHEMA_03" failed at 08:15:00: ERROR
1- You may create your rule to search for the word error and to send message and we can use the script as automatic action to get the previous lines and to append it to the annotation
Sample screenshots
2-You can create the policy to pre-process the log and write the output to a text file to be read.
cscript /nologo log.vbs backup.log ERROR >c:windowstempjoinedlines.txt
Ref: http://forums13.itrc.hp.com/service/forums/questionanswer.do?threadId=1474985
Mahmoud Ibrahim