Having problems with your account or logging in?
A lot of changes are happening in the community right now. Some may affect you. READ MORE HERE
Highlighted
Arunhclite Respected Contributor.
Respected Contributor.
793 views

Entire line not getting displayed in alert description

Jump to solution

Hi,

We have a Log file monitor configured alert with the attribute <<message>> in the description.

It displays the entire line in the alert description where the match string was found. But for the below line alone it doesn't displays the entire line.

Entire Line

[cal.common.logging] 2019-01-29 15:16:45,890 ERROR: [ service name: rsa.pro.sira.customer.riskdetails.get.V01.service:handleRequest ]: [ error type: SIRA Service exception <dsf:Code>E50050</dsf:Code>
<dsf:Type>ERROR</dsf:Type>
<dsf:Message>GeneralServiceException.</dsf:Message> ]: [ localized error: [server : LWWIPE68.opd.ads.uk.rsa-ins.com:5015(5011)] [dateTime: 2019-01-29T15:16:45.889] [version: V02] [errorCode : CAL_TEC_AC23] [internalErrorMsg: ::: AuditDoc: [1]:290120191516932039_QuoteID:MCAR00021389849Q] ]: [ uuid : 7c446200-9070-1d41-a2d2-ffffb2ecc151 ]

Displayed Line in Event Description

[cal.common.logging] 2019-01-29 15:16:45,890 ERROR: [ service name: rsa.pro.sira.customer.riskdetails.get.V01.service:handleRequest ]: [ error type: SIRA Service exception <dsf:Code>E50050</dsf:Code>

 

Match content - rsa.pro.sira.customer.riskdetails.get.V01.service:handleRequest

Kindly let me know whether Sitescope has limitations for specific characters.

Thanks,
Arunkumar.K

0 Likes
1 Solution

Accepted Solutions
Micro Focus Expert
Micro Focus Expert

Re: Entire line not getting displayed in alert description

Jump to solution

Posting the final results of the investigation here as well:

 

the string shows

**

[cal.common.logging] 2019-01-29 09:16:45,890 ERROR: [ service name: rsa.pro.sira.customer.riskdetails.get.V01.service:handleRequest ]: [ error type: SIRA Service exception <dsf:Code>E50050</dsf:Code>"CRLF"

<dsf:Type>ERROR</dsf:Type>"CRLF"

<dsf:Message>GeneralServiceException.</dsf:Message> ]: [ localized error:  [server : LWWIPE68.opd.ads.uk.rsa-ins.com:5015(5011)] [dateTime: 2019-01-29T15:16:45.889] [version: V02] [errorCode : CAL_TEC_AC23] [internalErrorMsg:  ::: AuditDoc: [1]:290120191516932039_QuoteID:MCAR00021389849Q] ]: [ uuid : 7c446200-9070-1d41-a2d2-ffffb2ecc151 ]"CRLF"

**

 

with "CRLF" being Carriage Return (ASCII 13, \r) Line Feed (ASCII 10, \n) characters,

so the one message actually consists of three lines, as there are two line breaks in it, and this reflects what SiteScope puts into the field <message>:

 

**

[cal.common.logging] 2019-01-29 15:16:45,890 ERROR: [ service name: rsa.pro.sira.customer.riskdetails.get.V01.service:handleRequest ]: [ error type: SIRA Service exception <dsf:Code>E50050</dsf:Code>

**

 

which is the string until it encounters the first CRLF.

 

I reviewed the code to check what is done, and found that the monitor uses a simple readline() function from the Java library

(see for example https://clicktime.symantec.com/3UgiQxHtYPVATQcaRuSmpLf7Vc?u=https%3A%2F%2Fdocs.oracle.com%2Fjavase%2F7%2Fdocs%2Fapi%2Fjava%2Fio%2FBufferedReader.html)

..

readLine

 

Reads a line of text. A line is considered to be terminated by any one of a line feed ('\n'), a carriage return ('\r'), or a carriage return followed immediately by a linefeed.

..

 

You mentioned in your case description that you encounter this issue with ONE line out of many only

..

It displays the entire line in the alert description where the match string was found. But for the below line alone it doesn't displays the entire line.

..

 

I can only guess that whatever tool / product generates the logfile(s) sometimes (obviously REALLY rarely) write three separate lines into the logfile.

I think that in reality the monitor considers there three lines as individual lines due to the CRLF at the end

 

[cal.common.logging] 2019-01-29 09:16:45,890 ERROR: [ service name: rsa.pro.sira.customer.riskdetails.get.V01.service:handleRequest ]: [ error type: SIRA Service exception <dsf:Code>E50050</dsf:Code>

 

<dsf:Type>ERROR</dsf:Type>

 

<dsf:Message>GeneralServiceException.</dsf:Message> ]: [ localized error:  [server : LWWIPE68.opd.ads.uk.rsa-ins.com:5015(5011)] [dateTime: 2019-01-29T15:16:45.889] [version: V02] [errorCode : CAL_TEC_AC23] [internalErrorMsg:  ::: AuditDoc: [1]:290120191516932039_QuoteID:MCAR00021389849Q] ]: [ uuid : 7c446200-9070-1d41-a2d2-ffffb2ecc151 ]

 

and processes them one by one, and gets a pattern match for the first one only.

 

Unfortunately there is absolutely nothing we can do about this on the SiteScope side. As long as the data producer can write multiple lines, separated by CRLF, into the logfile as one message,

there is no way for SiteScope to detect that this should be one line only. This could only be influenced on the message producing side.

 

Greetings
Siggi

 

Customer Support
Micro Focus

If you find that this or any post resolves your issue, please be sure to mark it as an accepted solution.
0 Likes
9 Replies
Micro Focus Expert
Micro Focus Expert

Re: Entire line not getting displayed in alert description

Jump to solution

Hi Arunkumar.K,

it is always very helpful to specify the product version ;-)

As you can see, there is a line break / line feed / newline character in the message after "<dsf:Code>E50050</dsf:Code>" (and after "<dsf:Type>ERROR</dsf:Type>" as well):
entire line
..
[cal.common.logging] 2019-01-29 15:16:45,890 ERROR: [ service name: rsa.pro.sira.customer.riskdetails.get.V01.service:handleRequest ]: [ error type: SIRA Service exception <dsf:Code>E50050</dsf:Code>
<dsf:Type>ERROR</dsf:Type>
<dsf:Message>GeneralServiceException.</dsf:Message> ]: [ localized error: [server : LWWIPE68.opd.ads.uk.rsa-ins.com:5015(5011)] [dateTime: 2019-01-29T15:16:45.889] [version: V02] [errorCode :
..

and SiteScope only uses the first part of the line:
..
[cal.common.logging] 2019-01-29 15:16:45,890 ERROR: [ service name: rsa.pro.sira.customer.riskdetails.get.V01.service:handleRequest ]: [ error type: SIRA Service exception <dsf:Code>E50050</dsf:Code>
..

so it seems that SiteScope only adds all the text until the first newline character to the variable <<message>>

I found many service requests enaling SiteScope to add extra newline characters, or NOT to add them, as each and every user wants it differently.

I'm pretty sure that this behaviour is nothing what can be changed or configured,
but to be on the safe side, can you please add a screenshot showing where exactly you added the attribute <<message>>?
In the alert descrption it would make too much sense:
..
Alert description  

Description of the alert. This description does not appear in any other context. It appears only when editing the alert.
..


Greetings
Siggi

Customer Support
Micro Focus

If you find that this or any post resolves your issue, please be sure to mark it as an accepted solution.
Arunhclite Respected Contributor.
Respected Contributor.

Re: Entire line not getting displayed in alert description

Jump to solution

Hi Siggi,

 

Thanks for the update.

In this log file which I have mentioned , which character denotes a  line break / line feed / newline character ?

Attached the event mapping setting screenshot.

 

Thanks,

Arunkumar.K

0 Likes
Micro Focus Expert
Micro Focus Expert

Re: Entire line not getting displayed in alert description

Jump to solution

Hi Arunkumar.K,

now I'm confused!

Based on your screenshot this looks like the definition of  BSM / APM EUM BPM Transaction alert,
and there the menue to setup a alert template??

Is this correct? Then I wouldn't know how you think you can use SiteScope alert message in a BPM alert setup??

I guess I got something wrong, perhaps you can clarify where (in what product part) you are doing what exactly.

If BSM/APM/OMi is involved, can you please provide the version?
The SiteScope version might be useful as well ...

Thanks
Siggi

Customer Support
Micro Focus

If you find that this or any post resolves your issue, please be sure to mark it as an accepted solution.
0 Likes
Arunhclite Respected Contributor.
Respected Contributor.

Re: Entire line not getting displayed in alert description

Jump to solution

Hi SIggi,

Again thanks for the quick response.

It is not BPM, this is a Sitescope event mapping settings. We have configure Event alert with the Event mapping option and the event gets forwarded to Omi.

HP SItescope - 11.32

OMi - 10.12

Attached the full view of the event mapping option.

Thanks,

Arunkumar.K

0 Likes
Arunhclite Respected Contributor.
Respected Contributor.

Re: Entire line not getting displayed in alert description

Jump to solution

Hi Siggi,

Is that for sure that the problem is with the ine break? So SItescope will read untill the line breaks only?

In that case, is there any specific character defines a line break?

 

Thanks,
Arunkumar.K

0 Likes
Micro Focus Expert
Micro Focus Expert

Re: Entire line not getting displayed in alert description

Jump to solution

Hey Arunkumar.K,

sorry for the delay in getting back to you.

So we have
- OMi 10.12 with SiteScope 11.32
- Sitescope Event Mapping Settings
event alerts with the Event mapping option have been setup and the event gets forwarded to Omi.

I'm not an OMi person, but I will give it a shot to start with.

As a first step simply check the file used by SiteScope and OA, <Sitescope>\logs\HPSiteScopeOperationsManagerIntegration.log
Open the file and search for the entries generated by your monitor in question, and see what the message contains.
If it's the first part only, it's SiteScope truncating the message after a certain character.
Then we can check if this can be changed (please note that SiteScope 11.32 is OOOOLD ...)

If it is the full message, you would need to move your attention to the Operations Agent, which - as far as my understanding goes - reads the message and passes it on to OMi.

As I don't support the agent nor OMI, I don't know how to see what the agent does, but I'm pretty sure that you can somehow force it to write all the data read into an OA logfile for further analysis.
If you see the full message in that logfile, OA and/or its policy read the full message and passes it on to OMi.

Once again, you would need to find out how to enable logging for that part of OA to see what exactly it sends to OMi.
If it is the first part of message only, OA truncates it.
If it is the full message, the issue is with OMi and needs to be check there further.

BTW, "<message>>" is not a general variable like <<severity>>, but exsist for the log and SNMP monitor only,
which might make the issue even more tricky.

Hope this helps
Siggi

Customer Support
Micro Focus

If you find that this or any post resolves your issue, please be sure to mark it as an accepted solution.
0 Likes
Arunhclite Respected Contributor.
Respected Contributor.

Re: Entire line not getting displayed in alert description

Jump to solution

Hi Siggi,

Thanks for the response.

As you have suggested the checked the Sitescope log HPSiteScopeOperationsManagerIntegration.log , the log text gets truncated after the line break.

So the problem is with Sitescope itself.

Also instead of <<message>> attribute, what can be given to get the full ERROR LINE from the log file.

 

Thanks,

Arunkumar.K

0 Likes
Micro Focus Expert
Micro Focus Expert

Re: Entire line not getting displayed in alert description

Jump to solution

This will be handled via the support case which has been opened some time ago

Siggi

Customer Support
Micro Focus

If you find that this or any post resolves your issue, please be sure to mark it as an accepted solution.
0 Likes
Micro Focus Expert
Micro Focus Expert

Re: Entire line not getting displayed in alert description

Jump to solution

Posting the final results of the investigation here as well:

 

the string shows

**

[cal.common.logging] 2019-01-29 09:16:45,890 ERROR: [ service name: rsa.pro.sira.customer.riskdetails.get.V01.service:handleRequest ]: [ error type: SIRA Service exception <dsf:Code>E50050</dsf:Code>"CRLF"

<dsf:Type>ERROR</dsf:Type>"CRLF"

<dsf:Message>GeneralServiceException.</dsf:Message> ]: [ localized error:  [server : LWWIPE68.opd.ads.uk.rsa-ins.com:5015(5011)] [dateTime: 2019-01-29T15:16:45.889] [version: V02] [errorCode : CAL_TEC_AC23] [internalErrorMsg:  ::: AuditDoc: [1]:290120191516932039_QuoteID:MCAR00021389849Q] ]: [ uuid : 7c446200-9070-1d41-a2d2-ffffb2ecc151 ]"CRLF"

**

 

with "CRLF" being Carriage Return (ASCII 13, \r) Line Feed (ASCII 10, \n) characters,

so the one message actually consists of three lines, as there are two line breaks in it, and this reflects what SiteScope puts into the field <message>:

 

**

[cal.common.logging] 2019-01-29 15:16:45,890 ERROR: [ service name: rsa.pro.sira.customer.riskdetails.get.V01.service:handleRequest ]: [ error type: SIRA Service exception <dsf:Code>E50050</dsf:Code>

**

 

which is the string until it encounters the first CRLF.

 

I reviewed the code to check what is done, and found that the monitor uses a simple readline() function from the Java library

(see for example https://clicktime.symantec.com/3UgiQxHtYPVATQcaRuSmpLf7Vc?u=https%3A%2F%2Fdocs.oracle.com%2Fjavase%2F7%2Fdocs%2Fapi%2Fjava%2Fio%2FBufferedReader.html)

..

readLine

 

Reads a line of text. A line is considered to be terminated by any one of a line feed ('\n'), a carriage return ('\r'), or a carriage return followed immediately by a linefeed.

..

 

You mentioned in your case description that you encounter this issue with ONE line out of many only

..

It displays the entire line in the alert description where the match string was found. But for the below line alone it doesn't displays the entire line.

..

 

I can only guess that whatever tool / product generates the logfile(s) sometimes (obviously REALLY rarely) write three separate lines into the logfile.

I think that in reality the monitor considers there three lines as individual lines due to the CRLF at the end

 

[cal.common.logging] 2019-01-29 09:16:45,890 ERROR: [ service name: rsa.pro.sira.customer.riskdetails.get.V01.service:handleRequest ]: [ error type: SIRA Service exception <dsf:Code>E50050</dsf:Code>

 

<dsf:Type>ERROR</dsf:Type>

 

<dsf:Message>GeneralServiceException.</dsf:Message> ]: [ localized error:  [server : LWWIPE68.opd.ads.uk.rsa-ins.com:5015(5011)] [dateTime: 2019-01-29T15:16:45.889] [version: V02] [errorCode : CAL_TEC_AC23] [internalErrorMsg:  ::: AuditDoc: [1]:290120191516932039_QuoteID:MCAR00021389849Q] ]: [ uuid : 7c446200-9070-1d41-a2d2-ffffb2ecc151 ]

 

and processes them one by one, and gets a pattern match for the first one only.

 

Unfortunately there is absolutely nothing we can do about this on the SiteScope side. As long as the data producer can write multiple lines, separated by CRLF, into the logfile as one message,

there is no way for SiteScope to detect that this should be one line only. This could only be influenced on the message producing side.

 

Greetings
Siggi

 

Customer Support
Micro Focus

If you find that this or any post resolves your issue, please be sure to mark it as an accepted solution.
0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.