Allow me to rephrase:
  1. You have a map between downtime message and uptime message.
  2. You want to parse out the downtime message and put it somewhere.
  3. Later, when the corresponding uptime message arrives, you want to append that to the downtime message (parsed earlier).

Ok. That is a lot clearer, but still not clear enough. Here's a few problems:

  1. Let's say you have two SQL Server instances, and both go down at different times. Both will probably come back up at different times. How are you going to match the uptime message to the right downtime message? (One possible solution is in the next point.)
  2. Your datastore (the place you're storing errors in) ... that's getting more and more complex. But, all you really need is: 
    (Error type) - (Who had the error) - (When did it happen) - (When was 
+it resolved)

    [download]

    Many of my esteemed brothers will take me to task for this, but it sounds like you really want a database for this. Now, I'm not suggesting you use Oracle or whatever, but even something like DBD::SQLite would be very handy. This way, you can easily find where in your datastore your corresponding downtime message is. Also, it will help you organize what you're actually keeping in your datastore.

  3. Of course, figuring out how to match the two SQL Server downtime messages may be easy. Figuring out how to do that for Net Gateway messages may also be easy. Figuring out a way of doing it for both at the same time may not be so easy.

I'm not trying to discourage you. These are questions that are necessary (imho) to answer before you can really get something usable up and running. (specially if, if I assume right, you will want (or be asked for) reporting on these downtimes. Any non-trivial reporting usually is benefited by the use of databases.

------
We are the carpenters and bricklayers of the Information Age.

The idea is a little like C++ templates, except not quite so brain-meltingly complicated. -- TheDamian, Exegesis 6

Please remember that I'm crufty and crochety. All opinions are purely mine and all code is untested, unless otherwise specified.

In reply to Re: Re: comma delimited, syslog parsing by dragonchild
in thread comma delimited, syslog parsing by jeff061

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.