How can I match the value 329 in this log-file without using multi-line (\n) ?
The regex for this one is that I want to match everything below 50 in that value, and generate an alarm.
With multi-line it would look something like this: /([0-9]|[0-4][0-9]|49)\nANR1462I/
run free_volumes Unnamed------------ 329ANR1462I RUN: Command script FREE_VOLUMES completed successfully.
Unnamed------------ 329ANR1462I RUN: Command script FREE_VOLUMES completed successfully.
Read something about the Format Rules, but not sure how to use it. Could someone please explain how to use it in this case?
The log snipped was not much to work with but the below profile for logmon should work for you.
<FormatRule> active = yes interval = 5 sec scanfile = <Enter your logfile/queue name> fileencoding = scanmode = updates alarm = yes qos = yes message = no subject = user = resetFile = no initialfileptr = 2 resumefileptr = 4 command_timeout_active = no command_timeout = command_severity = 2 command_timeout_alarm = 0 alarmFOpenFail = no clearFOpenFailRestart = no monitor_exit_code = No max_alarm_sev = 5 max_alarms = max_alarm_msg = password = <formats> <Startblock> active = yes start = *run\sfree_volumes* end = *ANR1462I* lines = 0 </Startblock> </formats> <watchers> <Numbermtach> active = yes match = [0-9]|[0-4][0-9]|49 level = information subsystemid = message = i18n_token = restrict = expect = no abort = no sendclear = no count = no separator = suppid = source = target = qos = runcommandonmatch = no alarm_on_first_match = no commandexecutable = commandarguments = pattern_threshold_severity = information pattern_threshold_message = timeout = 1 pattern_threshold = expect_message = expect_level = regexfromexternalfile = no patternfilepath = token = </Numbermtach> </watchers> </FormatRule>
Looks like you're running a TSM command - so presumably this is part of a script - if it is Linux, you could pipe the output through tr to convert the \n to space then it would all be on one line. Then you could use the regex capture to get the value.
TSM command | tr '\n' ' '