How to match a value with RegEx without using multiline in Logmon

[Rikard Thorin]

How can I match the value 329 in this log-file without using multi-line (\n) ?

The regex for this one is that I want to match everything below 50 in that value, and generate an alarm.

With multi-line it would look something like this: /([0-9]|[0-4][0-9]|49)\nANR1462I/

run free_volumes

 

  Unnamed[1]
------------
                   329
ANR1462I RUN: Command script FREE_VOLUMES completed successfully.

 

Read something about the Format Rules, but not sure how to use it. Could someone please explain how to use it in this case?

[Gene Howard]

HI,

 

The log snipped was not much to work with but the below profile for logmon should work for you.

 

<FormatRule>
      active = yes
      interval = 5 sec
      scanfile = <Enter your logfile/queue name>
      fileencoding =
      scanmode = updates
      alarm = yes
      qos = yes
      message = no
      subject =
      user =
      resetFile = no
      initialfileptr = 2
      resumefileptr = 4
      command_timeout_active = no
      command_timeout =
      command_severity = 2
      command_timeout_alarm = 0
      alarmFOpenFail = no
      clearFOpenFailRestart = no
      monitor_exit_code = No
      max_alarm_sev = 5
      max_alarms =
      max_alarm_msg =
      password =
      <formats>
         <Startblock>
            active = yes
            start = *run\sfree_volumes*
            end = *ANR1462I*
            lines = 0
         </Startblock>
      </formats>
      <watchers>
         <Numbermtach>
            active = yes
            match = [0-9]|[0-4][0-9]|49
            level = information
            subsystemid =
            message =
            i18n_token =
            restrict =
            expect = no
            abort = no
            sendclear = no
            count = no
            separator =
            suppid =
            source =
            target =
            qos =
            runcommandonmatch = no
            alarm_on_first_match = no
            commandexecutable =
            commandarguments =
            pattern_threshold_severity = information
            pattern_threshold_message =
            timeout = 1
            pattern_threshold =
            expect_message =
            expect_level =
            regexfromexternalfile = no
            patternfilepath =
            token =
         </Numbermtach>
      </watchers>
   </FormatRule>

[Garin Walsh]

Looks like you're running a TSM command - so presumably this is part of a script - if it is Linux, you could pipe the output through tr to convert the \n to space then it would all be on one line. Then you could use the regex capture to get the value.

 

TSM command | tr '\n' ' '

 

-Garin