Conference csc32::consolemanager

931.0. "Problem extracting events..." by 51678::MALM (My God! It's full of stars...) Fri Aug 18 1995 08:55

More problems...

Running PCM 1.6 ECO1 on a
WS4000/60 VMS6.1


I'd like to do the following:

An event triggers an action routine that does a "console extract" to get the
entire event, with context, written to a file so that we can process an analyze
the event and it's info.

I've come up to a "console extract/since=xxx system", and it works fine as
long as ther are NO OTHER events are coming in.
If there are events coming on the console line at the same time as the
action ruotine do the extract, the"/since=..." will go crazy and I'll get
a long list with every event that's in the database.

I have a command procedure that writes a number of >>>'s to the console (just
for the test). During the run of the procedure I do a "console extract".
The result can be found here... I have modified the output a little. There
were 1000's of lines. The extract also seemed to be looping, the output file
became 10000 blocks in a short time.

/Staffan

-------------------- cut here --------------------

$ console review/since=13:44:00/event struts


POLYCENTER Console Manager
Extract facility Version V1.6-110
Copyright (c) 1995 Digital Equipment Corporation. All Rights Reserved

                 >>>
HALTED_002       >>>	! These events are the output from my procedure
                 >>>
                 >>>
                 >>>
                 >>>
HALTED_002       >>>
                 >>>
                 >>>
                 >>>
                 >>>
HALTED_002       >>>
                 >>>
                 >>>
                 >>>
                 >>>		! The following is output from earlier this week !!!
ALN_INVPWD       %SECLGF, User on LTA5008 (ABISKO/UIC_000100000001) used an invalid password
ALN_ABRTLOG      %SECLGF, User on RTA1 has aborted the login
ALN_PROBNON      %SECLGF, User on RTA1 probes a nonexistant account
ALN_INVPWD       %SECLGF, User on RTA1 used an invalid password
ALN_INVPWD       %SECLGF, User on RTA1 used an invalid password
ALN_INVPWD       %SECLGF, User on RTA1 used an invalid password
ALN_INVPWD       %SECLGF, User on RTA1 used an invalid password
ALN_BREAKIN      %SECBRK, Break in by MALM from STRUTS
ALN_INVPWD       %SECLGF, User on RTA1 used an invalid password
ALN_BREAKIN      %SECBRK, Break in by MALM from STRUTS
ALN_INVPWD       %SECLGF, User on RTA1 used an invalid password
ALN_BREAKIN      %SECBRK, Break in by MALM from STRUTS
ALN_INVPWD       %SECLGF, User on RTA1 used an invalid password
ALN_BREAKIN      %SECBRK, Break in by MALM from STRUTS
ALN_INVPWD       %SECLGF, User on RTA1 used an invalid password
ALN_BREAKIN      %SECBRK, Break in by MALM from STRUTS
ALN_BREAKIN      %SECBRK, Break in by MALM from STRUTS
ALN_ABRTLOG      %SECLGF, User on RTA1 has aborted the login
HALTED_002       $ 
                 $ 
                 $ >>>
                 %DCL-W-NOCOMD, no command on line - reenter with alphabetic first character
                 $ 
showuser               VAX/VMS User Processes at 16-AUG-1995 10:02:12.15
                     Total number of users = 1,  number of processes = 1
                 
                  Username     Interactive  Subprocess   Batch
                  MALM              1


HALTED_002       >>>		! Here's the events from today again...
                 >>>		! NB! The date in the show user result
                 >>>
                 >>>
                 >>>
HALTED_002       >>>
                 >>>
                 >>>
                 >>>
                 >>>
HALTED_002       >>>
                 >>>
                 >>>
                 >>>
                 >>>
HALTED_002       >>>
                 >>>
                 >>>
                 >>>
                 >>>

>An event triggers an action routine that does a "console extract" to get the
>entire event, with context, written to a file so that we can process an analyze
>the event and it's info.

>I've come up to a "console extract/since=xxx system", and it works fine as
>long as ther are NO OTHER events are coming in.
>If there are events coming on the console line at the same time as the
>action ruotine do the extract, the"/since=..." will go crazy and I'll get
>a long list with every event that's in the database.
    
    I'm not surprised that this happens. Since you action routine uses
    /SINCE with no /BEFORE qualifier the only thing that will cause the
    EXTRACT to finish is an end of file condition. With all the events
    coming in the EOF keeps getting extended. Granted to code should 
    handle it better.
    
    I must also encourage you to abandon using command files to get the
    context info as it's horribly inefficent. The right way to do this is
    to write an image based action routine that uses the routines
    CMRetrieveEventtext and CMGetEventContext. These routines will retrieve
    the text and the context info for each event. It's much more efficient
    becuase your action routine will start when the first event comes in
    that successfuly passes through the filter that triggers your action
    and subsequent events will be passed to the running process.
    I can't encourage you enough to use the above method. 
    
    Regs,
      Dan

    Ok! I give up!
    
    We'll try to write the code piece...
    
    Is there anybody out there who has code pieces available for the rest
    of us? Code sharing...
    
    
    /Staffan

    There is an example in CONSOLE$EXAMPLES.  It doesn't have a call to the
    get context routines but it'll get you started.
    
    If you have questions as you go along feel free to post them here.
    
    REgs,
      Dan

Hi!

>    There is an example in CONSOLE$EXAMPLES.  It doesn't have a call to the
>    get context routines but it'll get you started.

Nope! I haven't found a single file in console$examples. I even did a reinstall
yesterday but there's no files there...

Do you have a copy to mail me?

/Staffan

    Yes I do. I found one I had worked on a while ago that I meant to
    publush. It already has the logic to retrieve the event text. It will
    attempt to do so 10 times with a 2 second wait between each attempt. 
    I placed it in
    
    CSC32::DUMPS:[BUTTERWORTH.PCM]RETRIEVE_EVENT_TXT_ACTION.C
    
    Enjoy!
    
    REgs,
      Dan