Bug 535725 (RHQ-2391)

Summary:	Logfile parser ignores lines where severity is not surrounded by spaces
Product:	[Other] RHQ Project	Reporter:	Heiko W. Rupp <hrupp>
Component:	Events	Assignee:	Jay Shaughnessy <jshaughn>
Status:	CLOSED CURRENTRELEASE	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	1.3pre	CC:	cwelton, jshaughn
Target Milestone:	---	Keywords:	SubBug
Target Release:	RHQ 4.3.0
Hardware:	All
OS:	All
URL:	http://jira.rhq-project.org/browse/RHQ-2391
Whiteboard:
Fixed In Version:	4.3	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:	case 333820
Last Closed:	2013-09-01 09:59:15 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	760116

Description Heiko W. Rupp 2009-08-28 12:51:00 UTC

Suppose you have a log line like this:

[2009.08.27-09:46:34] (INFO  )   Log4J Log Level

Our logfile reader allows to set the date format to '['yyyy.MM.dd-hh:mm:ss']' to match the date part, but matching will fail on '(INFO )', as the matcher expects that the severity is surounded by space.


Log4JLogEntryProcessor.REGEX == "(.*) (TRACE|DEBUG|INFO|WARN|ERROR|FATAL) (.*)"

We should perhaps allow (via some %x expressions for users to completely compose their entry format )

Comment 1 Red Hat Bugzilla 2009-11-10 21:03:31 UTC

This bug was previously known as http://jira.rhq-project.org/browse/RHQ-2391

Comment 2 wes hayutin 2010-02-16 16:52:07 UTC

Temporarily adding the keyword "SubBug" so we can be sure we have accounted for all the bugs.

keyword:
new = Tracking + FutureFeature + SubBug

Comment 3 wes hayutin 2010-02-16 16:58:06 UTC

making sure we're not missing any bugs in rhq_triage

Comment 4 Jay Shaughnessy 2012-01-12 18:49:57 UTC

master commit f9a99a4e1f83f3bc74b4fae5a8515914f69b15a5

I've updated our logEntry pattern handling to allow for bracket or paren
delimiters, with optional spacing, around the severity. So, the
following should all now match, for example:

    2012-01-05 11:42:13,607 INFO [org.foo.Baz] my message
    2012-01-05 11:42:13,607 [INFO] [org.foo.Baz] my message
    2012-01-05 11:42:13,607 ( INFO ) [org.foo.Baz] my message

Comment 5 Heiko W. Rupp 2013-09-01 09:59:15 UTC

Bulk closing of items that are on_qa and in old RHQ releases, which are out for a long time and where the issue has not been re-opened since.