Enterprise Content Management System Monitor 5.2

Size: px

Start display at page:

Download "Enterprise Content Management System Monitor 5.2"

Naomi Quinn
6 years ago
Views:

1 Enterprise Content Management System Monitor 5.2 Filtering of events Based on message content Revision CENIT AG Author: Michael Wohland Based on: Documents by J. Poiger and S. Bettighofer

2 PREFACE:... 3 DISCLAIMER:... 3 DESCRIPTION:... 3 CREATE A JAVASCRIPT:... 4 SAMPLE SCRIPT FOR FILTERING EVENTS USING SEARCH STRINGS:... 9 ANOTHER APPROACH SAMPLE SCRIPT FOR FILTERING EVENTS USING REGULAR EXPRESSIONS: COMBINATION OF BOTH SAMPLES: SAVE THE SCRIPT IN ESM: Nov. 07, 2017 ESM 5.2 Page 2 of 24

3 Preface: This document shows examples for filtering of events based on the content of the message text. Disclaimer: The content of this document is based on ESM in version The descriptions and guidelines in this document are for informational purposes only. Up-to-dateness, content completeness, appropriateness and validity for all possible scenarios cannot be guaranteed. All information is provided on an as-is basis. The author is not liable for any errors or omissions in this document or any losses, injuries and damages arising from its use. If you are planning to setup or configure ESM or to adjust an existing installation, it is absolutely necessary to take into account current security whitepapers, release notes and announcements from the official IBM ECM System Monitor product documentation website. Description: This guide gives an overview how to filter events using a JavaScript to find strings in the message of the event. When monitoring log files it is very often necessary to filter out log entries which are only informative or not necessary to be displayed in the ESM console. Some log files do not provide error ids to easily filter out these events using the mapping functionality. The ESM built-in mapping mechanism supplies means of Replacement Handlers (see User s Guide for details) but it is difficult to use them for string searches. The implementation of the script into the ESM event processing is fairly easy. Nov. 07, 2017 ESM 5.2 Page 3 of 24

4 Create a JavaScript: The scripting language used for this kind of scripts is JavaScript. ESM works with most general JavaScript objects, it does not support the HTML generic objects and methods (e.g. window, alert, ). A JavaScript can be tested in a HTML browser when it is wrapped as an html page: <html><head><title>test</title> </head><body> <script type="text/javascript"> </script> </body></html> When using the script in a browser context, input and output can be done using the object/methods window.prompt and alert or document.write to verify the function of the script. The script must be stripped of the ESM specific parts like return evt; or var message = evt.get("msg");. These parts can be commented by double slashes //. Sample html script: <html><head><title>test</title> </head><body> <script type="text/javascript"> //var message = evt.get("msg"); var message = window.prompt("input message text", ""); Nov. 07, 2017 ESM 5.2 Page 4 of 24

5 var discard=false; var currentfilterstring=new String(); var filterstrings=new Array(); /************************ Put actual strings to look for below. Use double quotes at beginning and end of string!!!important - Do not leave any unset cells in the array. You should be setting the array from index 0 to the last cell that you set without skipping any indices. Skipping indices results in an undefined value in the cell(s) that you skipped. Normally, that would not be a big deal, but it is in this case. Javascript will actually resolve an undefined value to the string literal, "undefined", if you use it in a string operation, which is what I'm doing here when checking against the message. If you leave any cells in the middle of your array unset, that will cause any message with the string, "undefined", in it to be filtered even if you didn't intend to. The word "undefined" being in an error message is not that rare at all. Nov. 07, 2017 ESM 5.2 Page 5 of 24

6 ************************/ filterstrings[0]="is not an error"; filterstrings[1]="abc"; filterstrings[2]="zzzzzz"; filterstrings[3]="info" filterstrings[4]="bb.*cc"; filterstrings[5]="^abc.*"; //...and so on for (var i=0;i<filterstrings.length;i++) currentfilterstring=filterstrings[i]; result=message.indexof(currentfilterstring); if (result > -1) //The currentfilterstring was found within the message. discard=true; alert("filterstrings[" + i + "] found: " + result); break; Nov. 07, 2017 ESM 5.2 Page 6 of 24

7 if (discard) //return null; alert("discarding event"); //Else, send it on through else //return evt; alert("sending event"); alert("script end!"); </script> </body></html> The highlighted lines will generate pop-ups like this: Nov. 07, 2017 ESM 5.2 Page 7 of 24

8 For use inside ESM, the html directives have to be removed. Only the script body is used for the event processing. Nov. 07, 2017 ESM 5.2 Page 8 of 24

9 Sample script for filtering events using search strings: With this sample script we will be able to define any number of strings or combinations of strings used to filter (discard) events for a certain datastream (specific log file monitoring). The different search strings are defined using strings (enclosed by ) stored in an array (filterstrings[i]). The events message is processed using the indexof() method in combination with the content of the filterstrings array. The indexof() method returns the position of the first occurrence of a specified value in a string. This method returns -1 if the value to search for never occurs. If a matching string is found in the events message, the event is discarded and the loop incrementing the array count is stopped. If no matching string is found, the event is returned to the calling script (streamproc_script) and event processing continues. Here is the script code: // // I I // I (c) CENIT AG (Stuttgart, Germany) I // I All Rights Reserved I // I Licensed Material - Property of CENIT AG I // function processevent(evt) var message = evt.get("msg"); Nov. 07, 2017 ESM 5.2 Page 9 of 24

10 // discard HARMLESS events if (evt.get("severity") == "HARMLESS") return null; else var discard=false; var currentfilterstring=new String(); var filterstrings=new Array(); /************************ Put actual strings to look for below. Use double quotes at beginning and end of string, no wildcards allowed.!!!important - Do not leave any unset cells in the array. You should be setting the array from index 0 to the last cell that you set without skipping any indices. Skipping indices results in an undefined value in the cell(s) that you skipped. Normally, that would not be a big deal, but it is in this case. Nov. 07, 2017 ESM 5.2 Page 10 of 24

11 Javascript will actually resolve an undefined value to the string literal, "undefined", if you use it in a string operation, which is what I'm doing here when checking against the message. If you leave any cells in the middle of your array unset, that will cause any message with the string, "undefined", in it to be filtered even if you didn't intend to. The word "undefined" being in an error message is not that rare at all. ************************/ filterstrings[0]="is not an error"; filterstrings[1]="abc"; filterstrings[2]="zzzzzz"; filterstrings[3]="info"; //...and so on for (var i=0;i<filterstrings.length;i++) currentfilterstring=filterstrings[i]; result=message.indexof(currentfilterstring); Nov. 07, 2017 ESM 5.2 Page 11 of 24

12 if (result > -1) //The currentfilterstring was found within the message. discard=true; break; if (discard) return null; //Else, send it on through else return evt; Nov. 07, 2017 ESM 5.2 Page 12 of 24

13 Another approach sample script for filtering events using regular expressions: This sample script is similar to the one shown above but uses regular expressions to search the strings. Due to the used test method it is more efficient than the indexof method. Regular expressions (enclosed by /) are stored in an array (filterregexps). The events message is processed using the test method in combination with the content of the filterregexps array. If a matching string is found in the events message, the event is discarded and the loop incrementing the array count is stopped. If no matching string is found, the event is returned to the calling script (streamproc_script) and event processing continues. Here is the script code: // // I I // I (c) CENIT AG (Stuttgart, Germany) I // I All Rights Reserved I // I Licensed Material - Property of CENIT AG I // function processevent(evt) var message = evt.get("msg"); // discard HARMLESS events Nov. 07, 2017 ESM 5.2 Page 13 of 24

14 if (evt.get("severity") == "HARMLESS") return null; else /******************************************** Filter by regular expression BE SURE YOU UNDERSTAND HOW REGULAR EXPRESSIONS WORK SPECIFICALLY IN JAVASCRIPT. ********************************************/ var currentregexp = new RegExp(); var filterregexps = new Array(); var discard = false; /********************************************* Define all regular expressions you want to try to match in the event's message. Nov. 07, 2017 ESM 5.2 Page 14 of 24

15 *********************************************/ filterregexps[0]=/is not an error/m; filterregexps[1]=/^.3abc.*/; filterregexps[2]=/info/i; filterregexps[3]=/bb.*cc/; filterregexps[4]=/^abc.*\. Def/; filterregexps[5]=/ds_init.*dtp.*exited with status '1'/; //...and so on for (var j=0;j<filterregexps.length;j++) currentregexp=filterregexps[j]; if (currentregexp.test(message)) //The currentregexp was found within the message. discard=true; break; Nov. 07, 2017 ESM 5.2 Page 15 of 24

16 if (discard) return null; //Else, send it on through else return evt; Nov. 07, 2017 ESM 5.2 Page 16 of 24

17 Combination of both samples: A combination of both samples is also possible. RegEx and search strings are used. Here is the script code: // // I I // I (c) CENIT AG (Stuttgart, Germany) I // I All Rights Reserved I // I Licensed Material - Property of CENIT AG I // function processevent(evt) var message = evt.get("msg"); // discard HARMLESS events if (evt.get("severity") == "HARMLESS") return null; Nov. 07, 2017 ESM 5.2 Page 17 of 24

18 else var discard=false; var currentfilterstring=new String(); var filterstrings=new Array(); /************************ Put actual strings to look for below.!!!important - Do not leave any gaps in the array. That leaves and undefined value in the cell. Javascript will actually use the string literal, "undefined", if you use the value in a string operation, which is exactly what I'm doing here when checking against the message. If you leave gaps in your array by skipping indices when setting the strings you want to filter, that will cause any message with the string, "undefined", in it to be filtered, and you won't even be aware of this. ************************/ //filterstrings[0]="pically occurs when outgoing connections are opened and closed at a high rate"; Nov. 07, 2017 ESM 5.2 Page 18 of 24

19 //filterstrings[1]="he time service has not synchronized the system time for"; //filterstrings[2]="a formatting library could not be found for the following inser"; //filterstrings[3]="the Terminal Server security layer detected an error in the protocol stream and has disconnected the client"; // and so on... for (var i=0;i<filterstrings.length;i++) currentfilterstring=filterstrings[i]; if (message.indexof(currentfilterstring) > -1) //The currentfilterstring was found within the message. discard=true; break; Nov. 07, 2017 ESM 5.2 Page 19 of 24

20 if (discard) return null; /******************************************** Filter by regular expression NOTE: Just keep the array empty if you don't want to do this. If you do, BE SURE YOU UNDERSTAND HOW REGULAR EXPRESSIONS WORK SPECIFICALLY IN JAVASCRIPT. ********************************************/ var currentregexp = new RegExp(); var filterregexps = new Array(); /********************************************* Define all regular expressions you want to try to match in the event's message.!!!important - Do not leave any gaps in the array. That leaves and undefined value in the cell. Nov. 07, 2017 ESM 5.2 Page 20 of 24

21 Javascript will actually use the string literal, "undefined", if you use the value in a string operation, which is exactly what I'm doing here when checking against the message. If you leave gaps in your array by skipping indices when setting the strings you want to filter, that will cause any message with the string, "undefined", in it to be filtered, and you won't even be aware of this. *********************************************/ //filterregexps[0]=/ds_init:.*exited with status '1'/; //filterregexps[1]=/driver.*required for printer.*is unknown/; //filterregexps[2]=/activation context generation failed for.*contentsearchservices/; //filterregexps[3]=/printer Fax.*will be deleted.*no user action is required/; //filterregexps[4]=/the jobs in the print queue for printer Fax.*were deleted/; for (var j=0;j<filterregexps.length;j++) currentregexp=filterregexps[j]; Nov. 07, 2017 ESM 5.2 Page 21 of 24

22 if (currentregexp.test(message)) //The currentregexp was found within the message. discard=true; break; if (discard) return null; //Else, send it on through else return evt; Nov. 07, 2017 ESM 5.2 Page 22 of 24

23 Save the script in ESM: After generating and testing the script, it needs to be incorporated into ESM. The scripts name is crucial as the event processing script (streamproc_script) automatically checks for scripts named like the datastream of the event concatenated with _script. For example,if the custom script should work for the FileNet P8 server error log events (datastream p8srverror), it must be named p8srverror_script. Care must be taken if already a default or custom script exists with that name. Check the content of that script and, if necessary, consolidate the two scripts. If a default and a custom script exists for the same datastream, the custom script has higher priority, the default script will not be executed. To save the script in ESM, open the Rules and Scripts Administration console and create a new custom script by duplicating the sample_script. Define the new script name according to the datastream (in my example datastream = teststream). Nov. 07, 2017 ESM 5.2 Page 23 of 24

24 Open the new script in the editor (double click or context menu edit ). Replace the text between the curly brackets with the tested script (stripped by the html and debug code). Save the script with the Apply button and use the triangle menu to activate the script by Apply Changes. Nov. 07, 2017 ESM 5.2 Page 24 of 24

Enterprise Content Management System Monitor 5.2. Mobile App Field Guide Revision CENIT AG Author: Michael Wohland

Enterprise Content Management System Monitor 5.2 Mobile App Field Guide Revision 1.0 16.08.2016 CENIT AG Author: Michael Wohland Table of Contents 1. Introduction... 3 1.1. Overview... 3 1.2. Disclaimer...