0

I am sorry if it is not right to post a question on two forums.

We use Tivoli to monitor our logs files. The log4j log level is set to ERROR and Tivoli would raise tickets for these statements. But there are some known issues for which we would not want Tivoli to raise tickets. Is there a way to specify that some statements need to be ignored ?

Current regex : [/var/tmp/abc.log;ERROR(.*);error found: RegExp1]

This is very generic. We need to exclude certain framework errors (Hibernate / Mule) for a known issue. Is there a way to specify using a regex ?

Thanks, Midhun

Arpit
  • 6,212
  • 8
  • 38
  • 69
Midhun Agnihotram
  • 165
  • 1
  • 3
  • 15

3 Answers3

0

If you are using the LO Agent you can configure situation formula based on regular expression to fit your needs.

Below the LO Agent User Guide http://pic.dhe.ibm.com/infocenter/tivihelp/v15r1/topic/com.ibm.itm.doc_6.2.3fp1/logfileagent623fp2_user.pdf

Take a look at the "Log File RegEx Statistics attribute group" section:

The Log File RegEx Statistics attribute group contains information that shows the statistics of the log file regular expression search expressions. Regular expressions can be used to filter records or to define records. This attribute group shows information about both types. When the Result Type attribute value is INCLUDE or EXCLUDE, the filter is used to filter records;

Hope this helps

I don't have the reputation yet to post a comment but I'd have liked to ask if you are using the Tivoli Log File Agent (lo) of the Unix Log Agent (ul) before answering.

Gaston Concilio
  • 53
  • 7
0

If your question is still actual... Here is documentationof LogAgent - http://www-01.ibm.com/support/knowledgecenter/SS4EKN_7.2.0.2/com.ibm.itm.doc_6.3/logfile/klo_fileformat_specs.htm

You can specify new Regex as DISCARDED and all records mathced this regex will be not catched by ITM Events.

If you use the special predefined event class DISCARD as your event class, any log records matching the associated pattern are discarded, and no events are generated for them. For example: REGEX DISCARD As a pattern matched, nothing is written to the unmatch log. The log file status records matched include these discarded events.

Igor
  • 21
  • 1
0

BTW 

[/var/tmp/abc.log;ERROR(.*);error found: RegExp1]

may be better as

[/var/tmp/abc.log;ERROR([^;]*);error found: RegExp1]

.* is greedy and best avoided when possible

That Robin
  • 75
  • 1
  • 9