Kaseya Community

Is it possible to create 1 alarm instead of 2 (online backup log parser)

This question is not answered

Dear Kaseya Community,

I have a backup log from online backup, the log looks as following


[2012/03/01 21:00:11] [info] Start [ Windows 2003 (win2003), AhsayOBM 6.7.0.0 ]
[2012/03/01 21:00:20] [info] Microsoft Exchange Server 2003 (6.5.7638)
[2012/03/01 21:00:27] [info] Start running pre-commands
[2012/03/01 21:00:29] [info] Finished running pre-commands
[2012/03/01 21:00:30] [info] Using Temporary Directory D:\Temp\BackupSet\1328785866601
[2012/03/01 21:00:30] [info] Start Microsoft Exchange backup ...
[2012/03/01 21:00:30] [info] [Start] Exchange Server - "WIN2003"
[2012/03/01 21:00:30] [info]   [Start] Service - "Microsoft Information Store"
[2012/03/01 21:00:30] [info]     [Start] Storage Group - "First Storage Group"
[2012/03/01 21:00:30] [erro] CExBackup::backupService:HrESEBackupSetup: Error Number 0xc80001f9: Backup is already active. 
[2012/03/01 21:00:40] [info]     [End] Storage Group - "First Storage Group"
[2012/03/01 21:00:40] [info]   [End] Service - "Microsoft Information Store"
[2012/03/01 21:00:40] [info] [End] Exchange Server - "WIN2003"
[2012/03/01 21:00:40] [info] End Microsoft Exchange backup.
[2012/03/01 21:00:40] [info] Start running post-commands
[2012/03/01 21:00:40] [info] Finished running post-commands
[2012/03/01 21:00:43] [info] Using Temporary Directory D:\Temp\BackupSet
[2012/03/01 21:00:43] [info] Downloading server file list ...
[2012/03/01 21:00:46] [info] Downloading server file list ... Completed
[2012/03/01 21:00:47] [info] Reading backup source from hard disk ...
[2012/03/01 21:00:47] [info] Reading backup source from hard disk ... Completed
[2012/03/01 21:00:49] [info] Total New Files = 0
[2012/03/01 21:00:49] [info] Total New Directory = 0
[2012/03/01 21:00:49] [info] Total Updated Files = 0
[2012/03/01 21:00:49] [info] Total Update File Permission = 0
[2012/03/01 21:00:49] [info] Total Deleted Files = 0
[2012/03/01 21:00:49] [info] Total Delete Directory = 0
[2012/03/01 21:00:49] [info] Total Moved Files = 0
[2012/03/01 21:00:49] [info] Deleting temporary file D:\Temp\BackupSet\1328785866601
[2012/03/01 21:00:49] [erro] Backup completed with error(s)


 

I created a Log File Parser Definition

Template (Multi-line template, yes):
[$Time$] [$type$] $msg$

Output Template:
Online backup completed with errors:
[$Time$] [$type$] $msg$

Log File Parameters:
Time - Date Time - YYYY/MM/DD hh:mm:ss
type - String
msg - String


I created a parser set
Parser Column: type
Operator: Contains
Parameter Filter: erro


 My log parser works, i get the following 2 alerts:

Alert1:

Online backup completed with errors:
[2012-03-01 23:00:30 +01:00] [erro] CExBackup::backupService:HrESEBackupSetup: Error Number 0xc80001f9: Backup is already active.
type: erro
msg: CExBackup::backupService:HrESEBackupSetup: Error Number 0xc80001f9: Backup is already active

 Alert2

Online backup completed with errors:
[2012-03-01 23:00:49 +01:00] [erro] Backup completed with error(s)
type: erro
msg: Backup completed with error(s)


 Now my question is, is it possible to generate 1 alert from the log like this:

Online backup completed with errors:
[2012-03-01 23:00:49 +01:00] [erro] Backup completed with error(s)
2012-03-01 23:00:30 +01:00] [erro] CExBackup::backupService:HrESEBackupSetup: Error Number 0xc80001f9: Backup is already active.

Glad to hear from you guys!

All Replies
  • Nobody?

  • how did you set up your log parser sets, under assign parser sets.

    If you created 2 separate sets, that's why you're getting 2 alarms. Also check your re-arm time.

    I don't think you're going to get your desiered end result though. The reason is that looking at your output, you're looking at 2 separate entries in the log file. The parser is going to check line by line but will not combine multiple lines for a single output. It's not that smart. You may want to use the parser to trigger a procedure that skims the last x lines of the log file and submit as an alert/ticket/email etc.. that'll give you a single output. It's a work around but I doubt Kaseya plans to upgrade the log parser, and i beleive that it's fairly old too.

    maybe add it as a feature request.

  • Alright danrche, thanks for your reply.