Bug 535725 (RHQ-2391) - Logfile parser ignores lines where severity is not surrounded by spaces
Summary: Logfile parser ignores lines where severity is not surrounded by spaces
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: RHQ-2391
Product: RHQ Project
Classification: Other
Component: Events
Version: 1.3pre
Hardware: All
OS: All
medium
medium vote
Target Milestone: ---
: RHQ 4.3.0
Assignee: Jay Shaughnessy
QA Contact:
URL: http://jira.rhq-project.org/browse/RH...
Whiteboard:
Depends On:
Blocks: jon30-sprint10, rhq43-sprint10
TreeView+ depends on / blocked
 
Reported: 2009-08-28 12:51 UTC by Heiko W. Rupp
Modified: 2013-09-01 09:59 UTC (History)
2 users (show)

Fixed In Version: 4.3
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
case 333820
Last Closed: 2013-09-01 09:59:15 UTC


Attachments (Terms of Use)

Description Heiko W. Rupp 2009-08-28 12:51:00 UTC
Suppose you have a log line like this:

[2009.08.27-09:46:34] (INFO  )   Log4J Log Level

Our logfile reader allows to set the date format to '['yyyy.MM.dd-hh:mm:ss']' to match the date part, but matching will fail on '(INFO )', as the matcher expects that the severity is surounded by space.


Log4JLogEntryProcessor.REGEX == "(.*) (TRACE|DEBUG|INFO|WARN|ERROR|FATAL) (.*)"

We should perhaps allow (via some %x expressions for users to completely compose their entry format )

Comment 1 Red Hat Bugzilla 2009-11-10 21:03:31 UTC
This bug was previously known as http://jira.rhq-project.org/browse/RHQ-2391


Comment 2 wes hayutin 2010-02-16 16:52:07 UTC
Temporarily adding the keyword "SubBug" so we can be sure we have accounted for all the bugs.

keyword:
new = Tracking + FutureFeature + SubBug

Comment 3 wes hayutin 2010-02-16 16:58:06 UTC
making sure we're not missing any bugs in rhq_triage

Comment 4 Jay Shaughnessy 2012-01-12 18:49:57 UTC
master commit f9a99a4e1f83f3bc74b4fae5a8515914f69b15a5

I've updated our logEntry pattern handling to allow for bracket or paren
delimiters, with optional spacing, around the severity. So, the
following should all now match, for example:

    2012-01-05 11:42:13,607 INFO [org.foo.Baz] my message
    2012-01-05 11:42:13,607 [INFO] [org.foo.Baz] my message
    2012-01-05 11:42:13,607 ( INFO ) [org.foo.Baz] my message

Comment 5 Heiko W. Rupp 2013-09-01 09:59:15 UTC
Bulk closing of items that are on_qa and in old RHQ releases, which are out for a long time and where the issue has not been re-opened since.


Note You need to log in before you can comment on or make changes to this bug.