Generic Log Adapter Release Notes

© Copyright International Business Machines Corporation 2000, 2006. All rights reserved. US Government Users Restricted Rights - Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.

Known problems and workarounds

1.0 Last record not processed when Generic Log Adapter runs continuously
1.1 Limitation when parsing WebSphere Application Server logs on UNIX
1.2 Limitation when parsing WebSphere MQ Error logs on UNIX
1.3 Problems parsing log files using runregex_showlog_example.bat/sh
1.5 Invalid Extended Data Elements generated
1.7 Generic Log Adapter logging information and limitations
1.8 No validation done on log file type
1.9 Limitation parsing WebSphere Application Server activity.log files
1.10 Limitation parsing log files generated in a different locale
1.12 Parsing log files with non-unique three-letter time zone symbols may return incorrect creation times for events
1.13 Common Base Events parsed for DB2 Express Diagnostic log are not to specification
1.14 Adapter Validation error when parsing log file
1.15 Formatter errors when parsing log file
1.16 Configuration problems when parsing logs

Additional readme information associated with TPTP Generic Log Adapter is available in the TPTP V4.2 release notes.

1.0 Last record not processed when Generic Log Adapter runs continuously

When Generic Log Adapter is continuously monitoring a log file it will not process the last record if there is no end pattern specified. The last record will only be processed when Generic Log Adapter is shutting down.

To ensure that the last record is processed during monitoring, provide an end pattern for the records in the Generic Log Adapter configuration file.

1.1 Limitation when parsing WebSphere Application Server logs on UNIX

When parsing WebSphere(R) Application Server binary activity or service logs on UNIXTM platforms using Generic Log Adapter, the user must have equal or greater privileges than the installer of WebSphere Application Server.

To work around this limitation, move the binary activity or service logs to a directory with the same privileges as the user of Generic Log Adapter before parsing the logs.

1.2 Limitation when parsing WebSphere MQ Error logs on UNIX

When parsing WebSphere MQ Error logs on UNIX platforms using Generic Log Adapter, the user must have equal or greater privileges than the installer of WebSphere MQ.

To work around this limitation, move the MQ Error logs to a directory with the same privileges as the user of Generic Log Adapter before parsing the logs.

1.3 Problems parsing log files using runregex_showlog_example.bat/sh

When trying to use the runregex_showlog_example.bat and the runregex_showlog_example.sh to parse a WebSphere Application Server activity log, the WebSphere Application showlog utility cannot be found.

To work around this problem, edit the file regex_showlog_example.adapter in the rule editor and update the Sensor Converter property to point to the proper directory location of WebSphere Application Server.

1.5 Invalid Extended Data Elements generated

Generic Log Adapter will generate an invalid extendedDataElements Common Base Event element for a log record if there is no rule that matches for either the name or type value. The extendedDataElement should not be generated if there is no name or type parsed from the log record but Generic Log Adapter will generate one with the value field only.

To work around this problem, ensure that rules are supplied that will cause all three fields - name, value, type - of the extendedDataElement to be matched.

1.7 Generic Log Adapter logging information

When Generic Log Adapter executes in stand-alone mode, outside an Eclipse environment, it logs messages and errors to a file called hgla.log in the current working directory. If the hgla.log file already exists in the current working directory, a new log file is created called hgla.nnnnnnnn.log where nnnnnnnn is a unique number. When Generic Log Adapter executes as part of a log import operation, the error messages it logs are displayed in an error dialog in Log and Trace Analyzer.

When executing inside an Eclipse environment in the Generic Log Adapter perspective, the messages and errors logged by Generic Log Adapter are listed in the Problems view.

Generic Log Adapter logs events with logging levels 5, 10, 20, 30, 50 and 60, depending on the setting of loggingLevel for the Contexts and Components in the adapter configuration file. The hgla.log file can be imported into Log and Trace Analyzer, as a Common Base Event XML file type, to diagnose problems encountered by Generic Log Adapter when parsing the log file.

1.8 No validation done on log file type

No validation is done by Generic Log Adapter to determine if the type of log file being parsed matches the adapter file configuration.  For example, if the log file specified in the sensor configuration in the adapter file is not of the type that the extractor configuration and substitution rules in the parser configuration were designed for, unpredictable results may occur.  The parsing may succeed without error but the resulting Common Base Event data will be incorrect.  The parsing may fail with error messages indicating incorrect data was encountered.

To work around this problem, ensure that the log file specified in the sensor component configuration is of the correct type.

1.9 Limitation parsing WebSphere Application Server activity.log files

When parsing binary WebSphere Application Server activity log files on non-English machines using runregex_showlog_example.bat/sh, the log record data will not be mapped successfully to a Common Base Event.  Instead, some log record data may appear in the incorrect field of the Common Base Event.

1.10 Limitation parsing log files generated in a different locale

When parsing log files that contain timestamps in a locale different than the locale that Generic Log Adapter is executing in, using a rules-based adapter file configured to use the Time Format attribute in the substitution rule for creationTime, the timestamp and other log record data may not be parsed correctly. For example, creationTime values in the resulting Common Base Events may be zero and the Common Base Event msg field may be blank.

To work around this problem, ensure that the values of the ISO language code and ISO country code attributes of Context Instance in the rules-based adapter file correspond to the locale of the timestamps in the log file to be parsed.

1.12 Parsing log files with non-unique three-letter time zone symbols may return incorrect creation times for events

When converting log files, that use three-letter time zone symbols, to Common Base Event format using Generic Log Adapter, incorrect creation times for log events may result if the three-letter time zone symbol is non-unique. For example, the three-letter symbol "IST" could be interpreted as Israeli Standard Time, Indian Standard Time, Iran Standard Time or Irish Summer Time.

1.13 Common Base Events parsed for DB2 Express Diagnostic log are not to specification

If you parse an IBM(R) DB2(R) Express Diagnositic log with the adapters in % GLA_Install%\GenericLogAdapter\config\DB2\diag\tool, the resulting Common Base Events written to the output file break some of the Common Base Event specification. This is due to a bug in the db2diag.exe utility which is used to convert DB2 Diagnostic logs to Common Base Events. This should not otherwise affect the parsing operation. There is no known work-around until db2diag.exe is fixed.

1.14 Adapter Validation error when parsing log file

Parsing a log file with an adapter file created using a previous version of Adapter Configuration Editor may cause the following error message to be written to the Generic Log Adapter log file, hgla.log:

IWAT0383E Adapter Validation Error: cvc-complex-type.4: Attribute 
'lineBreakSymbol' must appear on element 'ex:Extractor'.

Older versions of Adapter Configuration Editor created adapter files without the required Extractor attribute lineBreakSymbol. This attribute must be present in the Extractor element, even if it has an empty value. Generic Log Adapter now validates the adapter file against the Generic Log Adapter schema before using it and lineBreakSymbol is a required attribute in the schema.

To work around this problem, open the adapter file in the Adapter Configuration Editor, add a non-empty value to the lineBreakSymbol field of the Extractor element, save the adapter file, then delete that value if it is not required and save the file again. The adapter file will now contain the lineBreakSymbol attribute in the Extractor element.

1.15 Formatter errors when parsing log file

Parsing a log file with an adapter file created using a previous version of Adapter Configuration Editor may cause error messages like the following to be written to the Generic Log Adapter log file hgla.log:

IWAT0438E Common Base Event formatter N76D20B0042411D98000E0362B33D6F0 cannot 
create a CommmonBaseEvent because required property sourceComponentId is missing.

This message indicates that the formatter component of Generic Log Adapter could not create a Common Base Event because sourceComponentId is a required property of Common Base Event and it is missing. Generic Log Adapter now validates that all required properties are present in the Common Base Event and if there are missing properties, the Common Base Event is not returned. The adapter file may not have parsing rules for properties indicated in the messages or the parsing rules are not correct.

To work around this problem, add parser rules to the adapter file for the missing required Common Base Event properties or verify that exiting rules are correct.

1.16 Configuration problems when parsing logs

When parsing logs, the following error messages may be written to the console:

To work around this problem, make the following updates to the -classpath option in the gla.bat and gla.sh runtime script files: