[INUG-Users] extract statement not working

[Alex Greenbank]

Hello,

users-bounces at netcoolusers.org wrote on 30/09/2009 19:49:30:
> Hi all,
> I am trying to use an extract statement on the following:
> 
> LOCAL ALARM: BPV,LINE THRES= 5 16:31:10 09/30/2009
> 
> I am trying to extract the following:
> BPV,LINE THRES= 5
> 
> This does not match anything:
> $message = extract($1,"^.*:(.*)\s+$")
> 
> Is the Netcool rules syntax the same regex as Perl or are there some
> caveats.

There are plenty of differences.

http://publib.boulder.ibm.com/infocenter/tivihelp/v8r1/index.jsp?topic=/com.ibm.netcool_OMNIbus_probes.doc/welcome_genprb.htm

Appendix C of the Probe and Gateway guide should explain what
it does and doesn't support.

As some people have mentioned, there are two regex engines. The
original 'Netcool' regex engine did not provide multi-byte character
support. The newer 'TRE' regex engine does but, no surprise, will be
slightly slower.

Character classes like \s and \d are not supported by the Netcool
regex engine.

One recommendation is to use a regmatch to check before performing
an extract, that way you can easily add logging and error handling
when you did expect a string to match, i.e.

if( regmatch( $1, "^.*:(.*)\s+$" ) ) {
        # REF FOO123
        $message = extract($1,"^.*:(.*)\s+$")
} else {
        log( ERROR, "Failed to match string at FOO123 $1 = ["+$1+"]" )
}

> Could somebody show me the regex to get the above info 
> into a variable.

As for your problem:-

$1="LOCAL ALARM: BPV,LINE THRES= 5 16:31:10 09/30/2009"

I am trying to extract the following:
BPV,LINE THRES= 5

This does not match anything:
        $message = extract($1,"^.*:(.*)\s+$")

If you were using a regex engine that understood "\s" then "\s+"
would match one or more whitespace characters and therefore
"\s+$" would only match one or more whitespace characters at the
end of a string. If you string didn't have any whitespace on the
end then it wouldn't match.

I'd look at it like this. You want to grab everything after the
first : and before the date at the end. Since the date will be
in a pretty standard format then I'd simply do something like:-

# It's perfectly safe to leave the parentheses in a regmatch
# statement and means you can use exactly the same regex string
# for the regmatch and subsequent extract

if( regmatch( $1, "^[^:]*:(.*)..:..:.. ../../....$" ) ) {
        # REF FOO123
        $message = extract( $1, "^[^:]*:(.*)..:..:.. ../../....$" )
        # Trim away whitespace at beginning and end of string
        $message = ltrim( rtrim( $message ) )
} else {
        log( ERROR, "Failed to match string at FOO123 $1 = ["+$1+"]" )
}

This way it won't get tripped up by multiple bits of whitespace
before the string you want, or between that string and the date.

Ta,

-Alex





Unless stated otherwise above:
IBM United Kingdom Limited - Registered in England and Wales with number 
741598. 
Registered office: PO Box 41, North Harbour, Portsmouth, Hampshire PO6 3AU