IBM, AIX, 5.3

I would like to be able to run a script on an AIX server that would run the errrpt -a command and parse out the text of any errors found.  The script should know the diff(erences) between the last time it ran and now and only spit out new text/errors.

Preferably this script is written in ksh or posix.  Perl is acceptable but slightly less desirable in our shop as we won't be able to modify it as readily.
wrldzfststAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

ahoffmannCommented:
#!/bin/ksh
errrpt -a | egrep 'put in your error texts here' >/tmp/out.txtx 2>&1
diff /tmp/out.txtx /tmp/out.txt
mv /tmp/out.txtx /tmp/out.txt
0
wrldzfststAuthor Commented:
Thanks, I wish it was that easy.  Here is a sample of the errrpt output:

LABEL:          TS_LOC_DOWN_ST
IDENTIFIER:     173C787F

Date/Time:       Wed Apr 25 12:38:11 BST
Sequence Number: 30692
Machine Id:      005278AA4C00
Node Id:         ntlsso1tmra00
Class:           S
Type:            INFO
Resource Name:   topsvcs

Description
Possible malfunction on local adapter

Probable Causes
Local adapter mal-functioned
Local adapter lost connection to network
Local adapter mis-configured

Failure Causes
Local adapter mal-functioned
Local adapter lost connection to network
Local adapter mis-configured

        Recommended Actions
        Verify adapter configuration
        Verify network connectivity

Detail Data
DETECTING MODULE
rsct,nim_control.C,1.30.1.2,4106
ERROR ID
6zV5DL.Xqn94/YV1/tcKX8....................
REFERENCE CODE

Adapter interface name
en2
Adapter offset
           1
Adapter IP address
xx.xx.xx.xx
10.141.108.206

What I want to do is parse out the description and the date/time. Date time is easy, how do I parse out description, i.e. its the line after the literal "Description" that I want, then put both into a file and diff it from a previous file to only report on the latest problems
0
Adam314Commented:
The sample output you gave... does it then repeat for each error it finds?  Does each error always begin with LABEL?  Is the Description always 1 line?  If not, will it always have a blank line followed by Probable Causes?

This regex will get the line after Description (in perl):
/Description\n.*/;
0
Cloud Class® Course: SQL Server Core 2016

This course will introduce you to SQL Server Core 2016, as well as teach you about SSMS, data tools, installation, server configuration, using Management Studio, and writing and executing queries.

ahoffmannCommented:
> want to do is parse out the description ..
depends ...
do you care about some line after date/time in the parsed out put, then you simply can use the -A 3  option for egrep.
If you need the exact lines and some follow up lines for others (like description), then awk or perl is your fiend instead of egrep.
If you can make a uniq description how to extract "description", then awk might be sufficient. If you plan to extract more lines, I#d switch to perl right now.
0
wrldzfststAuthor Commented:
I am new to AIX and I just now got this assignent.  I need to get on the box and beat up on this, hopefully I can do that yet today once my uid comes through.  But, its my understanding from an IBM CE that  label repeats for every error, that there is only one description per error and it should always have a blank line before Causes.
0
ahoffmannCommented:
errrpt -a|awk '/^Date.Time/{print;next}/^Description/{print;d=1;next}(d==1){print;d=0;next;}'
# is this what you need?
0
Adam314Commented:
What info would you like in the final output?  

Does errrpt take it's info from some log file, and display it in another format?  If so, it might be easier to just rotate the log (or delete) after running errrpt - then you will only get new entries each time.

0
mikelfritzCommented:
errpt -a | grep -p -eDate -eDescription | grep -v -e"Sequence Number:" -e"Machine Id:" -e"Node Id:" -e"Class:" -e"Type:" -e"Resource Name:"
0
mikelfritzCommented:
errpt -a -s mmddhhmmyy

            where the mmddhhmmyy string equals the current month, day, hour,
            minute, and year will run it from mmddhhmmyy point to now.
0
mikelfritzCommented:
note - the command is errpt  ,  not errrpt.  Be sure to fix that if you copy and paste the suggestions from above.
0
mikelfritzCommented:
To put it all together:

If you store the date of the last run in a file called DATEFILE in the current dir (or modify below to spec a path)
#!/bin/ksh
# get the date of last run
DATE=`cat DATEFILE`
# get the current date
NOW=`date -u +%m%d%H%M%y`
# generate report and call it errorlog.[today]
errpt -a -s $DATE | grep -p -eDate -eDescription | grep -v -e"Sequence Number:" -e"Machine Id:" -e"Node Id:" -e"Class:" -e"Type:" -e"Resource Name:" > errorlog.$NOW
# reset the DATEFILE to current date
echo $NOW > DATEFILE

Open in new window

0
ahoffmannCommented:
mikelfritz. and where is the required diff?
0
mikelfritzCommented:
What diff?  The date?

The above pulls the date from a file containing mmddhhmm of last run and uses it as an option to errpt which pipes it through my grep mess (your awk solution would fit in there if he/she likes it better), then resets the date in the file for next time.

Maybe I'm missing your question.
0
ahoffmannCommented:
mikelfritz, maybe you're missing to read the initial question.
0
wrldzfststAuthor Commented:
So Mikelfritz, is what you are saying the diff can be avoided by running the report from a certain date to now?  Ultimately, what I want is, for each new error reported, the day/date it was reported in errpt and the text description.  I am going to hopefully hook these into a monitoring framework. The ideal output file would be:

Day/Date     Description
Day/Date     Description

of each new error (since the last time this report was run from this script, as you point out).

I will hopefully get to try this tomorrow, Monday latest and get back to you alll

Thanks for all of the help.
0
ahoffmannCommented:
> .. what I want is, for each new error reported, the day/date
am I right that you want only following lines from your errpt output if the Description changes compared to the last run of errpt:

Date/Time:       Wed Apr 25 12:38:11 BST
Description
Possible malfunction on local adapter

If so, would you mind that the stored file of such an error is tab delimited, i.e. as follows for the above example:
Wed Apr 25 12:38:11 BST        Possible malfunction on local adapter

Open in new window

0
ahoffmannCommented:
If this format is reasonable, do you then need the timestamp in the file, as it is saved in the file system (creation time of the file) anyway?
0
sjm_eeCommented:
Author:wrldzfstst Date:02.02.2008 at 03:18PM GMT

"what I want is, for each new error reported, the day/date it was reported in errpt and the text description. I am going to hopefully hook these into a monitoring framework."

If this is what you want then using "errpt -a" and parsing output is the wrong way to go about this. The parsing is a pain and there's an unlikely but real possibility of missing errors. I would recommend using "errnotify" objects. Basically each time an error is logged, you get to call a shell script if the error matches the criteria in the errnotify.

Here's a documented example:

http://publib.boulder.ibm.com/infocenter/pseries/v5r3/index.jsp?topic=/com.ibm.aix.howtos/doc/howto/HT_baseadmn_missingpv.htm
0
mikelfritzCommented:
>So Mikelfritz, is what you are saying the diff can be avoided by running the report from a certain date >to now?  

Yes.  If I run it on jan 1 2008 and get everything, then run it today and get everything - the only diff is from jan 1 2008 to now.  

You just need to create a file named DATEFILE containing the start date mmddhhmmyy ie: 0101010101
for jan 1 2001 at 1:01AM

For that format  (stealing some from ahoffman) awk is better for output, combine it with mine and:
#!/bin/ksh
# get the date of last run
DATE=`cat DATEFILE`
# get the current date
NOW=`date -u +%m%d%H%M%y`
# generate report and call it errorlog.[today]
errpt -a -s $DATE | awk '/^Date.Time/{printf("%s %s %2s %s %s %s    ",$2,$3,$4,$5,$6,$7);next}/^Description/{d=1;next}(d==1){print;d=0;next;}'  > errorlog.$NOW
# reset the DATEFILE to current date
echo $NOW > DATEFILE

Open in new window

0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
dfkeCommented:
Maybe something like this,put the errpt output in a file, mail that file if it is not empty...
#!/bin/ksh
# Generate an error report (overview only) for yesterday 0:00h until today 0:00h
# yesterday's date in a format understandable by errpt
YDAY=$(LANG='En_US' perl -e 'print scalar localtime (time() - 86400)'|\
awk 'BEGIN{
 mon["Jan"]=1;  mon["Feb"]=2;  mon["Mar"]=3;  mon["Apr"]=4
 mon["May"]=5;  mon["Jun"]=6;  mon["Jul"]=7;  mon["Aug"]=8
 mon["Sep"]=9;  mon["Oct"]=10; mon["Nov"]=11; mon["Dec"]=12
}
{
 print mon[$2] $3 "0000" substr($NF,3)
}')
# today's date in same format
TDAY=$(date +'%m%d0000%y')
# errpt call
errpt -s ${YDAY} -e ${TDAY} > /tmp/errpt.mail.$$
if test -s /tmp/errpt.mail.$$
then
 mail -s " errors occured at hostname.checkout "  your@email.net </tmp/errpt.mail.$$
fi
rm -f /tmp/errpt.mail.$$

Open in new window

0
wrldzfststAuthor Commented:
Thanks, this should work.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Unix OS

From novice to tech pro — start learning today.