Bug 535725 - (RHQ-2391) Logfile parser ignores lines where severity is not surrounded by spaces
Logfile parser ignores lines where severity is not surrounded by spaces
Product: RHQ Project
Classification: Other
Component: Events (Show other bugs)
All All
medium Severity medium (vote)
: ---
: RHQ 4.3.0
Assigned To: Jay Shaughnessy
: SubBug
Depends On:
Blocks: jon30-sprint10/rhq43-sprint10
  Show dependency treegraph
Reported: 2009-08-28 08:51 EDT by Heiko W. Rupp
Modified: 2013-09-01 05:59 EDT (History)
2 users (show)

See Also:
Fixed In Version: 4.3
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
case 333820
Last Closed: 2013-09-01 05:59:15 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Heiko W. Rupp 2009-08-28 08:51:00 EDT
Suppose you have a log line like this:

[2009.08.27-09:46:34] (INFO  )   Log4J Log Level

Our logfile reader allows to set the date format to '['yyyy.MM.dd-hh:mm:ss']' to match the date part, but matching will fail on '(INFO )', as the matcher expects that the severity is surounded by space.

Log4JLogEntryProcessor.REGEX == "(.*) (TRACE|DEBUG|INFO|WARN|ERROR|FATAL) (.*)"

We should perhaps allow (via some %x expressions for users to completely compose their entry format )
Comment 1 Red Hat Bugzilla 2009-11-10 16:03:31 EST
This bug was previously known as http://jira.rhq-project.org/browse/RHQ-2391
Comment 2 wes hayutin 2010-02-16 11:52:07 EST
Temporarily adding the keyword "SubBug" so we can be sure we have accounted for all the bugs.

new = Tracking + FutureFeature + SubBug
Comment 3 wes hayutin 2010-02-16 11:58:06 EST
making sure we're not missing any bugs in rhq_triage
Comment 4 Jay Shaughnessy 2012-01-12 13:49:57 EST
master commit f9a99a4e1f83f3bc74b4fae5a8515914f69b15a5

I've updated our logEntry pattern handling to allow for bracket or paren
delimiters, with optional spacing, around the severity. So, the
following should all now match, for example:

    2012-01-05 11:42:13,607 INFO [org.foo.Baz] my message
    2012-01-05 11:42:13,607 [INFO] [org.foo.Baz] my message
    2012-01-05 11:42:13,607 ( INFO ) [org.foo.Baz] my message
Comment 5 Heiko W. Rupp 2013-09-01 05:59:15 EDT
Bulk closing of items that are on_qa and in old RHQ releases, which are out for a long time and where the issue has not been re-opened since.

Note You need to log in before you can comment on or make changes to this bug.