Generic Log Adapter Release Notes

© Copyright International Business Machines Corporation 2000, 2006. All rights reserved. US Government Users Restricted Rights - Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.

Known problems and workarounds

1.0 Last record not processed when Generic Log Adapter runs continuously
1.1 Limitation when parsing WebSphere Application Server logs on UNIX
1.2 Limitation when parsing WebSphere MQ Error logs on UNIX
1.3 Problems parsing log files using runregex_showlog_example.bat/sh
1.5 Invalid Extended Data Elements generated
1.7 Generic Log Adapter logging information and limitations
1.8 No validation done on log file type
1.9 Limitation parsing WebSphere Application Server activity.log files
1.10 Limitation parsing log files generated in a different locale
1.12 Parsing log files with non-unique three-letter time zone symbols may return incorrect creation times for events
1.13 Common Base Events parsed for DB2 Express Diagnostic log are not to specification
1.14 Adapter Validation error when parsing log file
1.15 Formatter errors when parsing log file
1.16 Configuration problems when parsing logs

Additional readme information associated with TPTP Generic Log Adapter is available in the TPTP V4.2 release notes.

1.0 Last record not processed when Generic Log Adapter runs continuously

When Generic Log Adapter is continuously monitoring a log file it will not process the last record if there is no end pattern specified. The last record will only be processed when Generic Log Adapter is shutting down.

To ensure that the last record is processed during monitoring, provide an end pattern for the records in the Generic Log Adapter configuration file.

1.1 Limitation when parsing WebSphere Application Server logs on UNIX

When parsing WebSphere(R) Application Server binary activity or service logs on UNIXTM platforms using Generic Log Adapter, the user must have equal or greater privileges than the installer of WebSphere Application Server.

To work around this limitation, move the binary activity or service logs to a directory with the same privileges as the user of Generic Log Adapter before parsing the logs.

1.2 Limitation when parsing WebSphere MQ Error logs on UNIX

When parsing WebSphere MQ Error logs on UNIX platforms using Generic Log Adapter, the user must have equal or greater privileges than the installer of WebSphere MQ.

To work around this limitation, move the MQ Error logs to a directory with the same privileges as the user of Generic Log Adapter before parsing the logs.

1.3 Problems parsing log files using runregex_showlog_example.bat/sh

When trying to use the runregex_showlog_example.bat and the runregex_showlog_example.sh to parse a WebSphere Application Server activity log, the WebSphere Application showlog utility cannot be found.

To work around this problem, edit the file regex_showlog_example.adapter in the rule editor and update the Sensor Converter property to point to the proper directory location of WebSphere Application Server.

1.5 Invalid Extended Data Elements generated

Generic Log Adapter will generate an invalid extendedDataElements Common Base Event element for a log record if there is no rule that matches for either the name or type value. The extendedDataElement should not be generated if there is no name or type parsed from the log record but Generic Log Adapter will generate one with the value field only.

To work around this problem, ensure that rules are supplied that will cause all three fields - name, value, type - of the extendedDataElement to be matched.

1.7 Generic Log Adapter logging information

When Generic Log Adapter executes in stand-alone mode, outside an Eclipse environment, it logs messages and errors to a file called hgla.log in the current working directory. If the hgla.log file already exists in the current working directory, a new log file is created called hgla.nnnnnnnn.log where nnnnnnnn is a unique number. When Generic Log Adapter executes as part of a log import operation, the error messages it logs are displayed in an error dialog in Log and Trace Analyzer.

When executing inside an Eclipse environment in the Generic Log Adapter perspective, the messages and errors logged by Generic Log Adapter are listed in the Problems view.

Generic Log Adapter logs events with logging levels 5, 10, 20, 30, 50 and 60, depending on the setting of loggingLevel for the Contexts and Components in the adapter configuration file. The hgla.log file can be imported into Log and Trace Analyzer, as a Common Base Event XML file type, to diagnose problems encountered by Generic Log Adapter when parsing the log file.

1.8 No validation done on log file type

No validation is done by Generic Log Adapter to determine if the type of log file being parsed matches the adapter file configuration.  For example, if the log file specified in the sensor configuration in the adapter file is not of the type that the extractor configuration and substitution rules in the parser configuration were designed for, unpredictable results may occur.  The parsing may succeed without error but the resulting Common Base Event data will be incorrect.  The parsing may fail with error messages indicating incorrect data was encountered.

To work around this problem, ensure that the log file specified in the sensor component configuration is of the correct type.

1.9 Limitation parsing WebSphere Application Server activity.log files

When parsing binary WebSphere Application Server activity log files on non-English machines using runregex_showlog_example.bat/sh, the log record data will not be mapped successfully to a Common Base Event.  Instead, some log record data may appear in the incorrect field of the Common Base Event.

1.10 Limitation parsing log files generated in a different locale

When parsing log files that contain timestamps in a locale different than the locale that Generic Log Adapter is executing in, using a rules-based adapter file configured to use the Time Format attribute in the substitution rule for creationTime, the timestamp and other log record data may not be parsed correctly. For example, creationTime values in the resulting Common Base Events may be zero and the Common Base Event msg field may be blank.

To work around this problem, ensure that the values of the ISO language code and ISO country code attributes of Context Instance in the rules-based adapter file correspond to the locale of the timestamps in the log file to be parsed.

1.12 Parsing log files with non-unique three-letter time zone symbols may return incorrect creation times for events

When converting log files, that use three-letter time zone symbols, to Common Base Event format using Generic Log Adapter, incorrect creation times for log events may result if the three-letter time zone symbol is non-unique. For example, the three-letter symbol "IST" could be interpreted as Israeli Standard Time, Indian Standard Time, Iran Standard Time or Irish Summer Time.

1.13 Common Base Events parsed for DB2 Express Diagnostic log are not to specification

If you parse an IBM(R) DB2(R) Express Diagnositic log with the adapters in % GLA_Install%\GenericLogAdapter\config\DB2\diag\tool, the resulting Common Base Events written to the output file break some of the Common Base Event specification. This is due to a bug in the db2diag.exe utility which is used to convert DB2 Diagnostic logs to Common Base Events. This should not otherwise affect the parsing operation. There is no known work-around until db2diag.exe is fixed.

1.14 Adapter Validation error when parsing log file

Parsing a log file with an adapter file created using a previous version of Adapter Configuration Editor may cause the following error message to be written to the Generic Log Adapter log file, hgla.log:

IWAT0383E Adapter Validation Error: cvc-complex-type.4: Attribute 
'lineBreakSymbol' must appear on element 'ex:Extractor'.

Older versions of Adapter Configuration Editor created adapter files without the required Extractor attribute lineBreakSymbol. This attribute must be present in the Extractor element, even if it has an empty value. Generic Log Adapter now validates the adapter file against the Generic Log Adapter schema before using it and lineBreakSymbol is a required attribute in the schema.

To work around this problem, open the adapter file in the Adapter Configuration Editor, add a non-empty value to the lineBreakSymbol field of the Extractor element, save the adapter file, then delete that value if it is not required and save the file again. The adapter file will now contain the lineBreakSymbol attribute in the Extractor element.

1.15 Formatter errors when parsing log file

Parsing a log file with an adapter file created using a previous version of Adapter Configuration Editor may cause error messages like the following to be written to the Generic Log Adapter log file hgla.log:

IWAT0438E Common Base Event formatter N76D20B0042411D98000E0362B33D6F0 cannot 
create a CommmonBaseEvent because required property sourceComponentId is missing.

This message indicates that the formatter component of Generic Log Adapter could not create a Common Base Event because sourceComponentId is a required property of Common Base Event and it is missing. Generic Log Adapter now validates that all required properties are present in the Common Base Event and if there are missing properties, the Common Base Event is not returned. The adapter file may not have parsing rules for properties indicated in the messages or the parsing rules are not correct.

To work around this problem, add parser rules to the adapter file for the missing required Common Base Event properties or verify that exiting rules are correct.

1.16 Configuration problems when parsing logs

When parsing logs, the following error messages may be written to the console:

To work around this problem, make the following updates to the -classpath option in the gla.bat and gla.sh runtime script files:



Notices

This information was developed for products and services offered in the U.S.A.

IBM may not offer the products, services, or features discussed in this document in other countries. Consult your local IBM representative for information on the products and services currently available in your area. Any reference to an IBM product, program, or service is not intended to state or imply that only that IBM product, program, or service may be used. Any functionally equivalent product, program, or service that does not infringe any IBM intellectual property right may be used instead. However, it is the user's responsibility to evaluate and verify the operation of any non-IBM product, program, or service.

IBM may have patents or pending patent applications covering subject matter described in this document. The furnishing of this document does not grant you any license to these patents. You can send license inquiries, in writing, to:

IBM Director of Licensing
IBM Corporation
North Castle Drive
Armonk, NY 10504-1785
U.S.A.

For license inquiries regarding double-byte (DBCS) information, contact the IBM Intellectual Property Department in your country or send inquiries, in writing, to:

IBM World Trade Asia Corporation
Licensing
2-31 Roppongi 3-chome, Minato-ku
Tokyo 106-0032, Japan

The following paragraph does not apply to the United Kingdom or any other country where such provisions are inconsistent with local law: INTERNATIONAL BUSINESS MACHINES CORPORATION PROVIDES THIS PUBLICATION "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Some states do not allow disclaimer of express or implied warranties in certain transactions, therefore, this statement may not apply to you.

This information could include technical inaccuracies or typographical errors. Changes are periodically made to the information herein; these changes will be incorporated in new editions of the publication. IBM may make improvements and/or changes in the product(s) and/or the program(s) described in this publication at any time without notice.

Any references in this information to non-IBM Web sites are provided for convenience only and do not in any manner serve as an endorsement of those Web sites. The materials at those Web sites are not part of the materials for this IBM product and use of those Web sites is at your own risk.

IBM may use or distribute any of the information you supply in any way it believes appropriate without incurring any obligation to you.

Licensees of this program who wish to have information about it for the purpose of enabling: (i) the exchange of information between independently created programs and other programs (including this one) and (ii) the mutual use of the information which has been exchanged, should contact:

IBM Corporation
U59/600
3600 Steeles Ave East,
Markham, ON; L3R 9Z7
Canada

Such information may be available, subject to appropriate terms and conditions, including in some cases, payment of a fee.

The licensed program described in this document and all licensed material available for it are provided by IBM under terms of the IBM Customer Agreement, IBM International Program License Agreement or any equivalent agreement between us.

Any performance data contained herein was determined in a controlled environment. Therefore, the results obtained in other operating environments may vary significantly. Some measurements may have been made on development-level systems and there is no guarantee that these measurements will be the same on generally available systems. Furthermore, some measurements may have been estimated through extrapolation. Actual results may vary. Users of this document should verify the applicable data for their specific environment.

Information concerning non-IBM products was obtained from the suppliers of those products, their published announcements or other publicly available sources. IBM has not tested those products and cannot confirm the accuracy of performance, compatibility or any other claims related to non-IBM products. Questions on the capabilities of non-IBM products should be addressed to the suppliers of those products.

COPYRIGHT LICENSE:

This information contains sample application programs in source language, which illustrate programming techniques on various operating platforms. You may copy, modify, and distribute these sample programs in any form without payment to IBM, for the purposes of developing, using, marketing or distributing application programs conforming to the application programming interface for the operating platform for which the sample programs are written. These examples have not been thoroughly tested under all conditions. IBM, therefore, cannot guarantee or imply reliability, serviceability, or function of these programs.

Each copy or any portion of these sample programs or any derivative work, must include a copyright notice as follows:

(C) (your company name) (year). Portions of this code are derived from IBM Corp. Sample Programs. (C) Copyright IBM Corp. 2006. All rights reserved.

If you are viewing this information softcopy, the photographs and color illustrations may not appear.

Programming interface

Programming interface information is intended to help you create application software using this program.

General-use programming interfaces allow you to write application software that obtain the services of this program's tools.

However, this information may also contain diagnosis, modification, and tuning information. Diagnosis, modification and tuning information is provided to help you debug your application software.

Warning: Do not use this diagnosis, modification, and tuning information as a programming interface because it is subject to change.

Trademarks and service marks

The following terms are trademarks of the IBM Corporation in the United States or other countries or both:

Java and all Java-based trademarks are trademarks of Sun Microsystems, Inc. in the United States, other countries, or both.

Microsoft, Windows, Windows NT, and the Windows logo are trademarks of Microsoft Corporation in the United States, other countries, or both.

Intel, Intel Xeon, and Pentium are trademarks or registered trademarks of Intel Corporation or its subsidiaries in the United States and other countries.

UNIX is a registered trademark of The Open Group in the United States and other countries.

Linux is a registered trademark of Linus Torvalds in the United States, other countries, or both.

Other company, product, or service names may be trademarks or service marks of others.


(C) Copyright IBM Corporation 2000, 2006. All Rights Reserved.