Anonymous_User Absent Member.
Absent Member.
499 views

RegExp Parser Severity tag doesn't work


Hello!
I'm using FX adapter on my Novell Operations Center
I've written a parser based on RegularExpressionParser. It parses all
data correctly, but severity always sets to OK.
I've checked the code and compared it with DemoParser based on
DelimitedFileParser. The severity tags are absolutely similar there.
What am I doing wrong?
The code is below


Code:
--------------------
<parser>
<name>RegExp snmpgate Parser</name>
<class>com.mosol.integration.fx.parsers.RegExpParser</class>
<settings>
<expressions>
<expression name="MyExp1" columns="Time,Thread,Stat,Msg">([0123456789.:/-]{23}) (\[\w+-\d+\]) (ERROR|WARN|INFO) (.*)</expression>
</expressions>
<severities>
<severity column="Stat" condition="MINOR">WARN</severity>
<severity column="Stat" condition="CRITICAL">ERROR</severity>
<severity column="Stat" condition="OK">INFO</severity>
</severities>

</settings>
</parser>
--------------------


--
SmiLena
------------------------------------------------------------------------
SmiLena's Profile: http://forums.novell.com/member.php?userid=109527
View this thread: http://forums.novell.com/showthread.php?t=448410

Labels (1)
0 Likes
7 Replies
Anonymous_User Absent Member.
Absent Member.

Re: RegExp Parser Severity tag doesn't work

SmiLena,

It appears that in the past few days you have not received a response to your
posting. That concerns us, and has triggered this automated reply.

Has your problem been resolved? If not, you might try one of the following options:

- Visit http://support.novell.com and search the knowledgebase and/or check all
the other self support options and support programs available.
- You could also try posting your message again. Make sure it is posted in the
correct newsgroup. (http://forums.novell.com)

Be sure to read the forum FAQ about what to expect in the way of responses:
http://forums.novell.com/faq.php

If this is a reply to a duplicate posting, please ignore and accept our apologies
and rest assured we will issue a stern reprimand to our posting bot.

Good luck!

Your Novell Product Support Forums Team
http://forums.novell.com/

0 Likes
Anonymous_User Absent Member.
Absent Member.

Re: RegExp Parser Severity tag doesn't work


Hi there!
Try reversing the condition and Severity, so for example change:
<severity column="Stat" condition="MINOR">WARN</severity>
to
<severity column="Stat" condition="WARN">MINOR</severity>
and make sure that you are receiving a condition with "WARN" in the
actual input.

Let me know if that works.

Yon.


--
jgolan
------------------------------------------------------------------------
jgolan's Profile: http://forums.novell.com/member.php?userid=81153
View this thread: http://forums.novell.com/showthread.php?t=448410

0 Likes
Anonymous_User Absent Member.
Absent Member.

Re: RegExp Parser Severity tag doesn't work


jgolan, thank you for suggestion, but it doesn't work. The result is the
same.
It seems like severity tag doesn't work for RegExp parser, or it should
be defined in a special way.
http://i031.radikal.ru/1112/c9/4b2c899eed5f.png


--
SmiLena
------------------------------------------------------------------------
SmiLena's Profile: http://forums.novell.com/member.php?userid=109527
View this thread: http://forums.novell.com/showthread.php?t=448410

0 Likes
Anonymous_User Absent Member.
Absent Member.

Re: RegExp Parser Severity tag doesn't work


Hmmmm...
I've looked over your code and the only thing I can find that is
missing is a default severity. I actually think that I misread your
initial post, as it looks correct in terms of where the NOC condition
and Third Party condition are. Try to put a default severity in and see
if that fixes it.
I'm pasting an example that works below for your reference, let me know
if this makes a difference:


> <parser>
> <name>Regular Expression File Parser</name>
> <class>com.mosol.integration.fx.parsers.RegExpParser</class>
> <settings>
> <headerline>1</headerline>
> <startline>2</startline>
> <!--
> We're only interested in network connections that are established,
> so we filter out any line
> That doesn't contain the ESTABLISHED state
> -->
> <expressions>
> <expression name="Netstat Breakout" columns="Protocol,Receive
> Queue,Send Queue,Local Address,Foreign
> Address,State">([0-9A-Za-z]{4})\s+([0-9]+)\s+([0-9]+)\s+(.*)\s+(.*)\s+(ESTABLISHED.*)</expression>
> </expressions>
>
> <!--
> Severities are matched to the column names defined above in the
> columns attribute
> Because we are filtering out anything that is not in state
> ESTABLISHED above, we should never see CRITICAL
> Severities in Formula. If we do see a critical severity we know
> that something is wrong with our severity
> mapping or regular expression
> -->
> <severities>
> <default>CRITICAL</default>
> <severity column="State" condition="OK">ESTABLISHED</severity>
> </severities>
> </settings>
> </parser>
> </parsers>
>



--
jgolan
------------------------------------------------------------------------
jgolan's Profile: http://forums.novell.com/member.php?userid=81153
View this thread: http://forums.novell.com/showthread.php?t=448410

0 Likes
Anonymous_User Absent Member.
Absent Member.

Re: RegExp Parser Severity tag doesn't work


I've already tried this, but even if default is CRITICAL all alarms are
OK and green.
I've checked the content of Status column twice and it is exactly
"ERROR" or "WARN" without additional symbols.
Don't know what else I can do... :confused:


Code:
--------------------
<parsers>

<parser>
<name>RegExp snmpgate Parser</name>
<class>com.mosol.integration.fx.parsers.RegExpParser</class>
<settings>

<expressions>
<expression name="MyExp1" columns="Time,Thread,Status,alarmMessage">([0123456789.:/-]{23}) (\[.*\]) (ERROR|WARN) (.*)</expression>
</expressions>
<severities>
<default>CRITICAL</default>
<severity column="Status" condition="MINOR">WARN</severity>
<severity column="Status" condition="CRITICAL">ERROR</severity>
<!--severity column="Status" condition="OK">INFO</severity-->
</severities>

</settings>
</parser>

</parsers>
--------------------


jgolan, what version of NOC do you use? Maybe I need some recent patch
installed...


--
SmiLena
------------------------------------------------------------------------
SmiLena's Profile: http://forums.novell.com/member.php?userid=109527
View this thread: http://forums.novell.com/showthread.php?t=448410

0 Likes
Highlighted
Anonymous_User Absent Member.
Absent Member.

Re: RegExp Parser Severity tag doesn't work


I think you need to open a support ticket, because either something is
wrong with your config, or there is a bug in the adapter. I can't
remember which version of NOC I ran the above example on, but it was the
latest version of the FX adapter to the best of my knowledge.


--
jgolan
------------------------------------------------------------------------
jgolan's Profile: http://forums.novell.com/member.php?userid=81153
View this thread: http://forums.novell.com/showthread.php?t=448410

0 Likes
Anonymous_User Absent Member.
Absent Member.

Re: RegExp Parser Severity tag doesn't work


Well, I have to do it.
Thanks for trying to help me anyway 🙂


--
SmiLena
------------------------------------------------------------------------
SmiLena's Profile: http://forums.novell.com/member.php?userid=109527
View this thread: http://forums.novell.com/showthread.php?t=448410

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.