grep lines under the event header

[Jeeshan]

In my event.log i have entries like the following

.................................................................................................................

Summary:
Disk at hardware path 0/4/1/0.2.8.0.1.7.0 : Software configuration error

................................................................................

and the summaries are coming consecutively when an event happens.

I need to write a shell script to grep the lines bellow in the Summary heading. and also can able to filter of that output.

i.e. I need only the output

Summary:
Disk at hardware path 0/4/1/0.2.8.0.1.7.0 : Software configuration error

[Dennis Handly]

I assume the summaries are multiple lines but followed by a blank? or a line of "..."?

If a fixed number of lines, you could use GNU grep with -A4 to print 4 lines.

Otherwise you could use an awk state machine:
awk '
/^Summary:/ { flag=1 } # start
/^\.\.\.\./ { flag=0 } # end
flag { print $0 }
' event.log

[Jeeshan]

Thanks Dennis for your reply.

>>I assume the summaries are multiple lines but followed by a blank? or a line of "..."?

Yes, there are multiple lines before and after.

But how can I grep the lines, after the Summary in a POSIX shell?

[Jeeshan]

using the bellow command

tail -150 /var/opt/resmon/log/event.log|awk ' /^Summary:/ { flag=1 } /^\.\.\.\./ { flag=0 } flag { print $0 } '

I got the following results

Summary:
Adapter at hardware path 0/6/1/0 : Received an interrupt indicating that a
primitive was transmitted


Description of Error:


lbolt value: 3806

The Fibre Channel Driver received an interrupt indicating
that a primitive was transmitted
Frame Manager Status Register = 0xa0085480


Probable Cause / Recommended Action:

The Tachyon TL adapter transmitted a primitive sequence.
This is caused by the driver issuing a primitive sequence
to the chip to be transmitted.
No action is required. Informative message

Additional Event Data:
System IP Address...: 172.16.10.4
Event Id............: 0x49be522a00000000
Monitor Version.....: B.01.00
Event Class.........: I/O
Client Configuration File...........:
/var/stm/config/tools/monitor/default_dm_TL_adapter.clcfg
Client Configuration File Version...: A.01.00
Qualification criteria met.
Number of events..: 1
Associated OS error log entry id(s):
0x49be515c00000000
Additional System Data:
System Model Number.............: 9000/800/rp4440
OS Version......................: B.11.11
EMS Version.....................: A.04.00
STM Version.....................: A.47.00
Latest information on this event:
http://docs.hp.com/hpux/content/hardware/ems/dm_TL_adapter.htm#18

v-v-v-v-v-v-v-v-v-v-v-v-v D E T A I L S v-v-v-v-v-v-v-v-v-v-v-v-v



Component Data:
Physical Device Path....: 0/6/1/0
Vendor Id...............: 0x0000103C
Serial Number(WWN)......: 50060B0000305A1C

I/O Log Event Data:

Driver Status Code..................: 0x00000012
Length of Logged Hardware Status....: 0 bytes.
Offset to Logged Manager Information: 0 bytes.
Length of Logged Manager Information: 61 bytes.

Manager-Specific Information:

Raw data from FCMS Adapter driver:
00000006 00000EDE 00000001 00000001 A0085480 2F75782F 6B65726E 2F6B6973
752F544C 2F737263 2F636F6D 6D6F6E2F 7773696F 2F74645F 6973722E 63

but I only need the summary points descriptions.

[Hein van den Heuvel · Accepted solution]

I don't have a real file example for this handy, but it looks like you just want to use the 'range' selection that AWK offers.
Start with 'Sum' at the beginning of a line.
End with the first empty line.

$ awk '/^Sum/,/^$/' tmp.txt
Summary:
Adapter at hardware path 0/6/1/0 : Received an interrupt indicating that a
primitive was transmitted


Alternative:
$ awk '/^Sum/,!NF' tmp.txt


If I misinterpreted the data format/request, then please consider replying with a .TXT attachement for a section of the file with 2 target zones.

hth,
Hein.

[Jeeshan]

It perfectly worked, Hein. Thanks a lot man.

another question.

in my eventlog there is another field named
Event Time. and the format is

Event Time..........: Tue Mar 17 20:57:58 2009

my question is how can I reformat the "Tue Mar 17 2009" like this "17032009"

[James R. Ferguson]

Hi:

With regards to your last question of reformatting the date from the "Event" line you could use:

# cat ./filter
#!/usr/bin/perl -nl
BEGIN{
%m=(Jan=>1,Feb=>2,Mar=>3,Apr=>4,May=>5,Jun=>6,
Jul=>7,Aug=>8,Sep=>9,Oct=>10,Nov=>11,Dec=>12)};
m{^Event.+(\w{3})\s(\d\d).+\s(\d{4})} and
printf "%02d%02d%4d\n",$2,$m{$1},$3;
1;

For example:

# X="Event Time..........: Tue Mar 17 20:57:58 2009"
# echo ${X} | ./filter
17032009

Regards!

...JRF...

[Dennis Handly]

>how can I reformat the "Tue Mar 17 2009" like this "17032009"

Why would you want to format the date into something that doesn't sort?
20090317 would be better.

[James R. Ferguson]

Hi (again):

I would agree with Dennis, that the representation of the converted date as YYYYMMDD is a superior one.

Moreover, although I don't have a raw file, we can quickly the Perl script I offered to read you file, find the "SUmmary" lines _and_ convert the event date line like this:

# cat ./filter
#!/usr/bin/perl -nl
BEGIN{
%m=(Jan=>1,Feb=>2,Mar=>3,Apr=>4,May=>5,Jun=>6,
Jul=>7,Aug=>8,Sep=>9,Oct=>10,Nov=>11,Dec=>12)};

print if ( /^Summary/../^\s*$/ );

m{(^Event.+)(\w{3})\s(\d\d).+\s(\d{4})} and
printf "%s%4d%02d%02d\n",$1,$4,$m{$2},$3;
1;

...then:

# ./filter eventfile
Summary:
Adapter at hardware path 0/6/1/0 : Received an interrupt indicating that a
primitive was transmitted

Event Time..........: Tue 20090317

...

Regards!

...JRF...

[Jeeshan]

Thanks Dennis, yeah may be you are right. but my main concern to reformat the date is to verify from system date that the log is today's or yesterday's date and notify the Summary to Admins.

Thanks James for your reply.