I had seen so many questions about joining multiline log as in OMW the Log Interceptor is parsing line by line, so if your data is scattered on different lines it can not be monitoring unless you imply a pre-processing script.
I have created the below script is to join multiple lines together but if match a certain keyword
If Wscript.Arguments.Count < 2 Then wscript.echo "Usage cscript joinlines.vbs ""logfilepath"" ""machingtext"" " wscript.echo "Ex:" wscript.echo "cscript joinlines.vbs ""d:logsfilename.log"" logfilename " Else Set args = WScript.Arguments arg1 = WScript.Arguments.Item(0) match = WScript.Arguments.Item(1) Set fsObject = CreateObject("Scripting.FileSystemObject") nodesFile = arg1 Set file = fsObject.GetFile(nodesFile) Set line = file.OpenAsTextStream(1,TristateUseDefault) dim arrFileLines()
DoUntil line.AtEndOfStream RedimPreserve arrFileLines(l) arrFileLines(l) = line.ReadLine l = l + 1 Loop For l = Ubound(arrFileLines) to LBound(arrFileLines) Step -1 If Instr(arrFileLines(l), match) > 0 then wscript.echo "maching line " & arrFileLines(l-1) &" " & arrFileLines(l) endif Next
Save the contents to joinlines.vbs
It can be implemented in different ways:
You can create a log file policy to search for your error message in each line as the sample below
20110326 08:00:13 expdp_SHARED_DATASTAGE.sql started ok 20110326 08:14:13 expdp_SHARED_DATASTAGE.sql completed ok with this output: The job "EXPDP_USER". "SYS_EXPORT_SCHEMA_06" failed at 08:15:00: ERROR 20110327 08:00:13 expdp_SHARED_DATASTAGE2.sql started ok 20110327 08:14:13 expdp_SHARED_DATASTAGE2.sql completed ok with this output: The job "EXPDP_USER2". "SYS_EXPORT_SCHEMA_02" failed at 08:15:00: ERROR 20110328 08:00:13 expdp_SHARED_DATASTAGE3.sql started ok 20110328 08:14:13 expdp_SHARED_DATASTAGE3.sql completed ok with this output: The job "EXPDP_USER2". "SYS_EXPORT_SCHEMA_03" failed at 08:15:00: ERROR
1- You may create your rule to search for the word error and to send message and we can use the script as automatic action to get the previous lines and to append it to the annotation
2-You can create the policy to pre-process the log and write the output to a text file to be read.