Mappings for XPath functions to SQL statements

Log and Trace Analyzer uses a DB2(R) database for large log support. When analyzing large logs, the IBM Log Analyzer converts all XPath functions to SQL statements. XPath rules are ignored, during analysis, if their functions cannot be converted to SQL statements.

Note: You must use the Symptom database editor to create XPath rules.

The following table lists the mapping of XPath functions to SQL statements. Those specified as not supported are XPath functions that do not map to SQL statements.

XPath function SQL statement
Boolean Not supported
ceiling(number) Not supported
Concat(string1, string2, string3) Not supported
contains()
  • Select all events that have a message attribute that contains the string 'program error': CommonBaseEvent[contains(@msg, 'program error')]
  • Select all events that have an extendedDataElement named 'ProductName' and contains a value 'WebSphere': CommonBaseEvent[extendedDataElements[@name = 'ProductName' and contains(values,'WebSphere') and @type = 'string']]
LIKE
  • SELECT * FROM cei_t_event WHERE msg LIKE '%program error%'
  • SELECT * FROM cei_t_event WHERE global_id IN ( SELECT ext.global_id FROM cei_t_ext_element ext WHERE ext.name = 'ProductName' AND ext.level = 0 AND ext.string_value like '%WebSphere%' AND ext.data_type = 7)
Count Not supported
false()
  • Exp = false() maps to not(exp)
  • Exp != false() maps to exp
first() Not supported
floor(number) Not supported
id() Not supported
lang() Not supported
last() Not supported
local-name() Not supported
name() Not supported
namespace-uri() Not supported
normalize-space(string) Not supported
not(@name) NOT EXISTS
number(string) Not supported
position() Not supported
Round(number) Not supported
starts_with()
  • Select all events that have a msg attribute that starts with 'ADMIN': CommonBaseEvent[starts-with(@msg,'ADMIN')]
LIKE
  • SELECT * FROM cei_t_event_ WHERE msg LIKE 'ADMIN%'
String() Not supported
string-length(string) Not supported
substring(string, num1, num2) Not supported
substring_after(string1, string2) Not supported
substring_before(string1, string2) Not supported
sum() Not supported
Translate(string1, string2, string3) Not supported
true()
  • Exp = true() maps to exp
  • Exp != true() maps to not(exp)

Related concepts
Symptom databases

Related tasks
Importing a symptom database
Importing a log file
Analyzing log records using IBM Log Analyzer

Related reference
Symptom Analysis Results view