Kaseya Community

Log Parser

  • Hiya - I have set up a log parser for the following backup logfile but not getting any results - unsure of what I am doing wrong /if I am giving the parser enough info (as in the below log example would be hard to do}, using the following template:
    $Msg${tab}$Time${tab}

    Have set the set definition for Msg to be equal to Error: and Warning: have also tried without the colon and used the following template
    $Msg$:{tab}$Time${tab}



    Message: 20:00:10 Thu, 27 November 2008 8:00:10 PM - V5.0.2-8 : Scheduled backup started
    Message: 20:00:10 OS: Windows 2003,5.2,x86
    Message: 20:00:10 Using backup account: username_company
    Message: 20:00:10 Connecting to Storage Platform on ns1.olbackup.co.uk:443
    Message: 20:00:10 SSL Server name: Name Server, Name Server1, London
    Message: 20:00:12 [System State Plugin] Running system state backup
    Message: 20:00:12 [System State Plugin] Waiting for system state backup to complete
    Message: 20:12:17 [System State Plugin] Backup completed with exitcode: 0
    Message: 20:12:17 Preparing selection database
    Warning: 20:16:41 Selected file missing (removed from backup): F:\autorun.inf
    Message: 20:16:42 Initial file set prepared
    Message: 20:16:42 Total selection: 108.51 GB in 156,420 files and folders
    Message: 20:16:42 Using backup account: username_customer
    Message: 20:16:42 Connecting to Storage Platform on ns1.olbackup.co.uk:443
    Message: 20:16:42 SSL Server name: Name Server, Name Server1, London
    Error: 20:16:45 You have exceeded your backup limit of 86.60 GB by 21.91 GB.
    Message: 20:16:45 Using backup account: username_customer
    Message: 20:16:45 Connecting to Storage Platform on ns1.olbackup.co.uk:443


    Any help would be awesome - cheers

    Legacy Forum Name: Log Parser,
    Legacy Posted By Username: sdevereux
  • Have you tried setting it to parse the whole directory for the logs? F:\Program Files\Attix5 Backup Professional SE\logs\*.log I have confirmed the log files do not tab delimit, but I still can't get this to parse the errors. I have created a set and shared it with you. Is this what you have for your Template? It may pay to open the template, and copy and paste one of the lines into the template field, and then replace the various sections with placeholders... this would guarantee you are matching the right characters in the string. If anyone can help, I have this as the logparsers.xml for this machine

    <?xml version="1.0" encoding="ISO-8859-1" ?>
    <LogParser version="1.0" AgentID="87367884311199837408207267">
    	<LogParserDef ID="2">
    		<Params>
    			<Param Name="MessageStatus" Type="string" ParamID="8" />
    			<Param Name="TimeStamp" Type="string" ParamID="9" />
    			<Param Name="ErrorMessage" Type="string" ParamID="10" />
    		</Params>
    		<Templates MultiLine="0">
    			<Template>$MessageStatus$: $TimeStamp$ $ErrorMessage$</Template>
    		</Templates>
    		<OutputTemplate>$MessageStatus$ The following Error occurred $TimeStamp$ $ErrorMessage$</OutputTemplate>
    		<LogPaths>
    			<CurrentPath>F:\Program Files\Attix5 Backup Professional SE\logs\*.log</CurrentPath>
    			<BackupPath></BackupPath>
    		</LogPaths>
    		<CollectionDef>
    			<ConditionSet>
    					<Condition Param="null" Operator="StartWith" Value="Warn" />
    					<Condition Param="null" Operator="StartWith" Value="Err" />
    			</ConditionSet>
    		</CollectionDef>
    		<Alarms>
    			<AlarmDef ID="2" Duration="0" EventCount="1" ReArm="86400">
    				<ConditionSet>
    					<Condition Param="null" Operator="StartWith" Value="Warn" />
    					<Condition Param="null" Operator="StartWith" Value="Err" />
    				</ConditionSet>
    			</AlarmDef>
    		</Alarms>
    	</LogParserDef>
    </LogParser>
    


    Legacy Forum Name: General Discussion,
    Legacy Posted By Username: mparr



    [edited by: Brendan Cosgrove at 12:40 PM (GMT -8) on 12-13-2010] .