in reply to Re: adaptive syslog message parsing
in thread adaptive syslog message parsing
Ok, I couldn't resist!
add:
use Algorithm::Diff;
toward the start. In sub add change:
push @{$context->{tails}}, $line;
to:
push @{$context->{tails}}, [$line =~ /(\S+)/g];
In sub mergeTails replace everything after:
my @groups;
with:
push @{$groups[@$_]}, $_ for @tails; @groups = grep {defined $_} @groups; for my $group (@groups) { my @ref = @{$group->[-1]}; my @org = @ref; my $count = 1; pop @$group; while (@$group) { my @new = @{pop @$group}; my @diffs = Algorithm::Diff::diff (\@ref, \@new); for my $change (@diffs) { next unless $change->[0][0] eq '-'; $ref[$change->[0][1]] = undef; } ++$count; } for (0 .. $#ref) { next if defined $ref[$_]; $org[$_] = '*****'; } push @{$context->{digest}}, [join (' ', @org), $count]; }
Now prints:
infocache02 ldap_cachemgr (1) Error: Unable to refresh from profile:tls_automount_profil +e. (error=1) (1) libsldap: Status: 91 Mesg: openConnection: simple bind fai +led - Can't connect to the LDAP server sendmail (3) ***** Losing ***** savemail panic (2) ***** SYSERR(root): savemail: cannot save rejected email a +nywhere mail2-in postfix/smtpd (2) warning: 84.9.96.201: address not listed for hostname mail +.intechcentre.com (4) warning: ***** hostname ***** verification failed: hostnam +e nor servname provided, or not known mail2-out ntpd (5) ***** Bad file descriptor postfix/smtp (1) warning: valid_hostname: empty hostname (1) warning: malformed domain name in resource data of MX reco +rd for hotmil.com: postfix/smtp[32282] (1) warning: numeric domain name in resource data of MX record + for uyahoo.com: 10.0.0.2
|
|---|
| Replies are listed 'Best First'. | |
|---|---|
|
Re^3: adaptive syslog message parsing
by Anonymous Monk on Jun 07, 2007 at 17:20 UTC | |
by GrandFather (Saint) on Jun 07, 2007 at 19:54 UTC |