Filter
Top Products
The log file adapter will attempt to match this system log message to the most
specific format specification. In this case, the event matches the
Root_Login_Success_From format specification. The event created by the log file
adapter will therefore have an event class of Root_Login_Success_From. The
following mappings then take place:
Mapping Assignments Source of Mapping
$1="Dec 10 09:45:06" From the %t component specification
$2="sawmill" From the first %s component specification
$3="ttyp6" From the second %s component specification
$4="oak" From the third %s component specification
date="Dec 10 09:45:06" From $1
hostname="sawmill" From $2
origin= 9.37.43.12" From the default value of the origin
attribute, as derived by the log file adapter
sub_source="login" From the constant string
on_tty="ttyp6" From $3
from_host="oak" From $4
-extra=", with extra stuff!" From the constant string
msg="root login from oak, with extra
stuff!"
From the PRINTF statement
The following list describes how values were assigned:
v The date and hostname attributes were inherited from the Logfile_Base class
(through the Logfile_Login, Root_Login, and Root_Login_Success classes).
v The origin attribute was also inherited from the Logfile_Base class, and was
assigned the adapter default.
v The msg attribute was not inherited from the Logfile_Base class, because it was
overridden by the Root_Login_Success_From class.
v The sub_source attribute was inherited from the constant string defined in the
Logfile_Login class.
v The on_tty attribute was inherited from the Root_Login_Success class.
v The from_host attribute was explicitly defined on the
Root_Login_Success_From class.
v The extra attribute was defined as a temporary attribute. It is not forwarded to
the event server as a part of this event.
There are a couple of other interesting items to note from this example:
v In the PRINTF value specification for the msg attribute in the
Root_Login_Success_From class, two %s conversions are specified without any
intervening white space. This allows the final msg attribute value to be created
without any space between the string oak and the comma.
v In the Root_Login format specification, there are no explicit mappings; all
mappings are inherited. This allows class name specialization without changing
any attribute values. Any event that matches the Logfile_Login class has the
same attributes and values as those that match the Root_Login class, but the
class name is different.
v Variables are resolved from the matching format specification, even if they are
inherited. For example, if the msg attribute had not been overridden with the
152 IBM Tivoli Enterprise Console: Adapters Guide