$('a[name]').remove(); $('#ic-homepage__footer').before('

'); $("#tabs").tabs({ selected: 1 }); $("#ic-homepage__ic-tips").append( quickTipHTML() ); unhideOneProductTip(); $("#ic-homepage__product-tips").wrapInner('

'); $("#ic-homepage__feed-tips").wrapInner('

'); });

IBM Tivoli Monitoring > Version 6.3 > User's Guides > Log File Agent User's Guide > Format file IBM Tivoli Monitoring, Version 6.3


Maps

The Tivoli Log File Agent uses mappings to determine the event class for a system log message. The agent determines the event class by matching the message to a pattern in the format file.

The agent translates log messages in to event class instances that contain attribute name=value pairs. The event is then sent to the event server.

The agent determines the event class for a system log message at the source. The agent determines the event class by matching a system log message to a pattern in the format file. After you use this matching procedure to determine a class, you must assign values to the attributes.

Attribute values come from various sources, such as:

A map statement is included in the format file and it consists of the following syntax:

Here, you specify any identifier to describe the name of a slot (also known as a variable, attribute, or value identifier). Then, you specify a value to assign to this slot by applying any of the values that are described in Value specifiers.

Use custom slots to view data in the Tivoli Enterprise Portal and to define situations. When creating situations, all custom slot values are strings. Custom slots are also needed to get duplicate detection to work because you must identify the slots used to determine duplicates. For more information about filtering events, see Event filtering and summarization. msg is a special slot name, with its own attribute in the event table. You do not need to use a custom slot for the msg.

You can limit the scope of a slot so that it exists only within the format definition. When you define the slot, you precede the slot name with a dash, for example:

Any slot that you define in this way is not included in the final event. However, you can reference the slot elsewhere in the format definition, specifically within a PRINTF statement. In the REGenericSyslog example that follows, the service slot is not included in the event that you generate but you can reference it in the PRINTF statement. It retains the same value that was applied to the original slot when it was defined without the dash. Using this procedure you can use temporary variables from the format definition that are not included in the final event. For example, you can define an event class, REGenericSyslog, to match generic UNIX syslog events in the following way:


Parent topic:

Format file

+

Search Tips   |   Advanced Search