ALERT: Some images may not load properly within the Knowledge Base Article. If you see a broken image, please right-click and select 'Open image in a new tab'. We apologize for this inconvenience.

Logmon profile one digit number error issue when using match expression regex

book

Article ID: 239221

calendar_today

Updated On:

Products

DX Unified Infrastructure Management (Nimsoft / UIM) DX Unified Infrastructure Management (Nimsoft / UIM) Unified Infrastructure Management for Mainframe CA Unified Infrastructure Management SaaS (Nimsoft / UIM)

Issue/Introduction

We have noticed that our logmon configuration is not seeing in log more than one digit from number. For example, instead of creating alerts with number 255 it is creating only with 5. What we have found, it is the problem with \d regex pattern, so we have replaced it with \d+ to be able to see 3 digit numbers, but it did not help. We are using logmon variables. Could you please advise how we can fix an issue?

Old watcher match expression:
/\[(.*)\]\s*\b(\w+).EVENT:.(\w+)\s*\w+:\s(JOBFAILURE).*JOB:.(\w+).*MACHINE:.(\w+).*EXITCODE:.*(\d)/

New watcher match expression:
/\[(.*)\]\s*\b(\w+).EVENT:.(\w+)\s*\w+:\s(JOBFAILURE).*JOB:.(\w+).*MACHINE:.(\w+).*EXITCODE:.*(\d+)/

Example log entry from the log file being monitored:

[04/07/2022 05:14:28]      CAUAJM_I_40245 EVENT: ALARM            ALARM: JOBFAILURE       JOB: xxxx_xxx_xxx_xxx_xx_MDMS_register_read_daily MACHINE: xxxxxxxxxx EXITCODE:  255

Message to send on match:
AutoSys Alert: ${date} ${event} ${alarm} Job: ${job} on machine: ${machine} had exitcode=${ec}

Alert wrongly created with exitcode=5 instead of 255 as well as other multi-digit number also be displayed as single digits.

Cause

- regex

Environment

Release : 20.3

Component : UIM LOGMON

logmon v4.11

Resolution

regex needed a 'slight' adjustment.

Here is the slightly changed MATCH expression using negative lookahead: 

/\[(.*)\]\s*\b(\w+).EVENT:.(\w+)\s*\w+:\s(JOBFAILURE).*JOB:.(\w+).*MACHINE:.(\w+).*EXITCODE:\s\s(\d+)/