User-Defined Variables in Patterns

Any matched string can be assigned to a variable, which can be used to compose events. To define a parameter, add ". parametername " before the closing bracket. The pattern:

    ^errno: <#.number> - <*.error_text>

matches an event such as:

    errno: 125 - device does not exist 

and assigns "125" to number and "device does not exist" to error_text.

When using these variables, the syntax is <variable_name> (for example, <number>).

Rules by which Operations Agent assigns strings to variables

In matching the pattern <*.var1><*.var2> against the string "abcdef", it is not immediately clear which substring of the input string will be assigned to each variable. For example, it is possible to assign an empty string to var1 and the whole input string to var2, as well as assigning "a" to var1 and "bcdef" to var2, and so forth.

The pattern matching algorithm always scans both the input line and the pattern definition (including alternative expressions) from left to right. <*> expressions are assigned as few characters as possible. <#>, <@>, <S> expressions are assigned as many characters as possible. Therefore, var1 will be assigned an empty string in the example above.

To match an input string such as:

    this is error 100: big bug

use a pattern such as:

    error<#.errnumber>:<*.errtext>

In which:

• "100" is assigned to errnumber
• "big bug" is assigned to errtext

For performance and pattern readability purposes, you can specify a delimiting substring between two expressions. In the above example, ":" is used to delimit <#> and <*>.

Matching <@.word><#.num> against "abc123" assigns "abc12" to word and "3" to num, as digits are permitted for both <#> and <@>, and the left expression takes as many characters as possible.

Patterns without expression anchoring can match any substring within the input line. Therefore, patterns such as:

    this is number<#.num>

are treated in the same way as:

    <*>this is number<#.num><*>

Using subpatterns to assign strings to variables

In addition to being able to use a single operator, such as * or #, to assign a string to a variable, you can also build up a complex subpattern composed of a number of operators, according to the following pattern: <[ subpattern ].var>

For instance: <[<@>file.tmp].fname>

In the example above, the period ( . ) between "file" and "tmp" matches a similar dot character, while the dot between "]" and "fname" is necessary syntax. This pattern would match a string such as "Logfile.tmp" and assigns the complete string to fname.

Other examples of subpatterns are:

• <[Error|Warning].sev>
• <[Error[<#.n><*.msg>]].complete>$

In the first example above, any line with either the word "Error" or the word "Warning" is assigned to the variable, sev. In the second example, any line containing the word "Error" has the error number assigned to the variable, n, and any further text assigned to msg. Finally, the word "Error", the error number, and the text are assigned to complete.

The second example requires the dollar sign ($) at the end to anchor the expression. As mentioned above, patterns without expression anchoring can match any substring within the input line. Therefore, the pattern:

<[Error[<#.n><*.msg>]].complete>

would be treated as:

<*><[Error[<#.n><*.msg>]].complete><*>

Patterns are evaluated from left to right, and <*> expressions are assigned as few characters as possible. Therefore, without a dollar sign ($) to anchor the end of the expression, the <*.msg> expression always matches zero characters, and the remainder of the line is matched with the implicit <*> expression at the end.