Plugin:Logparser

From collectd Wiki
Jump to: navigation, search
Logparser plugin
Type: read
Callbacks: init, config, read, shutdown
Status: supported
First version: 5.11
Copyright: 2017-2018 Intel Corporation
Krzysztof Matczak
Marcin Mozejko
License: MIT license
Manpage: collectd.conf(5)
List of Plugins

The logparser plugin is used to parse different kinds of logs. Setting proper options you can choose strings to collect. Plugin searches the log file for messages which contain several matches (two or more). When all mandatory matches are found then it sends proper notification containing all fetched values.

This utility simplifies filtering and parsing specific messages from given log file. It tracks log file using utils_tail_match.h API.

Main feature is automatic messages assembly based on set of user provided regular expressions containing distinguished expressions for recognizing start and the end of the message. That makes assembling single message from multiple log lines quite easy. Utility supports multiple parsing jobs and also user defined message part validation flags (mandatory or not).

Synopsis

<Plugin logparser>
  <Logfile "/var/log/syslog">
    FirstFullRead false
    <Message "pcie_errors">
      DefaultType "pcie_error"
      DefaultSeverity "warning"
      <Match "aer error">
        Regex "AER:.*error received"
        SubmatchIdx -1
      </Match>
      <Match "incident time">
        Regex "(... .. ..:..:..) .* pcieport.*AER"
        SubmatchIdx 1
        IsMandatory false
      </Match>
      <Match "root port">
        Regex "pcieport (.*): AER:"
        SubmatchIdx 1
        IsMandatory true
      </Match>
      <Match "device">
        PluginInstance true
        Regex " ([0-9a-fA-F:\\.]*): PCIe Bus Error"
        SubmatchIdx 1
        IsMandatory false
      </Match>
      <Match "severity_mandatory">
        Regex "severity="
        SubMatchIdx -1
      </Match>
      <Match "nonfatal">
        Regex "severity=.*\\([nN]on-[fF]atal"
        TypeInstance "non_fatal"
        IsMandatory false
      </Match>
      <Match "fatal">
        Regex "severity=.*\\([fF]atal"
        Severity "failure"
        TypeInstance "fatal"
        IsMandatory false
      </Match>
      <Match "corrected">
        Regex "severity=Corrected"
        TypeInstance "correctable"
        IsMandatory false
      </Match>
      <Match "error type">
        Regex "type=(.*),"
        SubmatchIdx 1
        IsMandatory false
      </Match>
     <Match "id">
        Regex ", id=(.*)"
        SubmatchIdx 1
      </Match>
    </Message>
  </Logfile>
</Plugin>


Example graph

None yet. Add one now!

Dependencies

Caveats

See also