[log in to unmask] wrote:
>
> X-no-Archive:yes
> At a previous company, I wrote a job that was streamed immediately after the
> switchlog. It would parse the output of showlog, decrement the number, then
> run the sysdiag tools to dump it to an identically named file in another
> group. The job would then grep the dumped output for any of several strings
> of interest. I'm sorry that I cannot point you to an example of the actual
> job scripting to do this, but it ought to be pretty straight-forward to
> implement.

I wrote a shell & awk script for use on invent3k to condense 6.5 LOGTOOL output
into a more readable one line per event format.  I'm only interested in just a
few event types, so there's much that is missing here, but you should be able
to get an idea of the power the POSIX shell and utilities gives you:

#!/bin/sh

#
# Daily system logfile analyzer.
#

# Establish high water mark filename and temp file name prefix.

HWMFILE=/CSY/REPORTS/LOGTOOL.hwm
TEMP=/CSY/PUB/tmp/lt.$$
rm -fR $TEMP.*

# Switch to a new logfile and save the number of the last complete logfile.

LAST=$(callci switchlog | awk ' { print substr($4,2) }')

# Obtain the first logfile number from the previous run of this script, or
# from a day ago as reported by the find command.

if [ -s $HWMFILE ]; then
  read FIRST <$HWMFILE
  FIRST=$((FIRST+1))
else
  FIRST=$(find /SYS/PUB -name 'LOG[0-9][0-9][0-9][0-9]' -mtime -1 |\
    head -l 1 | sed -e 's/.*LOG0*\(.*\)$/\1/')
fi

# Generate the input commands for /SYS/PUB/LOGTOOL

cat >$TEMP.cmd <<EOF
status detail
summarize log=$FIRST/$LAST
list log=$FIRST/$LAST;type=102,115,145
exit
EOF

# Run /SYS/PUB/LOGTOOL to generate the raw output

callci "file input=$TEMP.cmd"
/SYS/PUB/LOGTOOL >$TEMP.raw
callci "reset input"

rm -f $TEMP.cmd

# Reduce and reformat the raw output into something prettier.

awk -v first=$FIRST -v last=$LAST '\
# Initialize regexp strings for the first and last logfiles.
BEGIN { first = sprintf("^LOG%04d",first); last = sprintf("^LOG%04d",last); }

# Count how many commands have been seen so far.
$1 == "LOGTOOL>" { command = command+1 }

# For the STATUS command, only print our specific logfiles and
# miscellaneous non-logfile header lines.
$1 ~ first,$1 ~ last { print; next }
command == 1 && $1 !~ /^LOG/ { print; next }

# A line consisting entirely of equal signs (=) delimits a logging event.
/^==*$/ {
  events = 1;
  getline;
  if (NF == 0) exit; # Blank line means end of event data.
  type = "UNKNOWN";
  date=substr($0,1,17); time=substr($0,21,8); # Save timestamp info.
  getline;
  type = $0; # Save logging event type.
  next; }

# Make sure the SUMMARIZE command output is printed.
command > 1 && events != 1 { print; next }

# Logging event 102 - job initiation
type ~ "JOB INITIATION" {
  job = substr($0,21,8); user = substr($0,61,8); getline;
  group = substr($0,21,8); account = substr($0,61,8); getline;
  logon = substr($0,21,8); getline;
  success = $6; getline; getline; getline; getline;
  status = $6;

  if (user !~ /^[A-Z]/) user = "<NULL>";
  if (account !~ /^[A-Z]/) account = "<NULL>";

  # Generate the implied logon string.

  hello = "";
  if (job !~ /^ /) hello = job ",";
  hello = hello user "." account;
  if (logon !~ /^ /) hello = hello "," logon;
  gsub(/ /,"",hello);

  # Flag it if it was unsuccessful.

  if (success == 0 && status == "Successful") {
    msg = ""
  } else {
    msg = "***FAILED*** [" success "/" status;
    if (status ~ /009B$/) {
      # Obtain the CI error message corresponding to the status value.
      system("callci escape \\" substr(status,1,5));
      cmd = "callci echo !hpcierrmsg";
      cmd | getline hpcierrmsg; close(cmd);
      sub(/  *$/,"",hpcierrmsg);
      msg = msg "/" hpcierrmsg;
    }
    msg = msg "]";
    success = 1;
  }

  if (success != 0) print "***\n***\n***";
  printf "%s  %s * %s %s\n",date,time,hello,msg;
  if (success != 0) print "***\n***\n***";
  type = "UNKNOWN";
  next;
}

# Logging event 115 - console I/O
type ~ "CONSOLE LOG" {
  if ($1 == "(INPUT)") {
    inout="<"
  } else {
    inout=">"
  };
  data=substr($0,9); getline;

  # Concatenate continuation lines.
  while ($0 !~ /^USER: /) {
    data=data $0;
    getline;
  };

  printf "%s  %s %s %s\n",date,time,inout,data;
  type = "UNKNOWN";
  next;
}

# Logging event 145 - CI command log
type ~ "CI COMMAND LOG" {
  user=$3; account=$6; job=substr($0,64,8);

  hello = "";
  if (job !~ /^ /) hello = job ",";
  hello = hello user "." account;
  gsub(/ /,"",hello);

  getline; getline; cmdlen = $3; getline;

  if (cmdlen < 61) {
    data = substr($0,21,cmdlen)
  } else {
    getline;
    data = $0
  }

  printf "%s  %s : %s :%s\n",date,time,hello,data;
  type = "UNKNOWN";
  next;
}' $TEMP.raw

# Clean up the temp files.

rm -fR $TEMP.*

# Save the high water mark for next time.

echo $LAST >$HWMFILE

--
[log in to unmask]
Remainder of .sig suppressed to conserve scarce California electrons...

* To join/leave the list, search archives, change list settings, *
* etc., please visit http://raven.utc.edu/archives/hp3000-l.html *