<![CDATA[Event Log parsing]]>I am trying to parse the windows application event log to look for sql agent jobs failures.
I want the full windows event log text sent over email since there can be a lot of job fails.

Agent parse file configuration looks like this

<parser>
  <file>*Application</file>
  <rules>
    <rule>
      <severity>6</severity>
      <match>(SQL Server Scheduled Job)*(Message: The job failed)*</match>
      <event params="1">100025</event>
    </rule>
  </rules>
</parser>
If I let it configured like this it will only send some generic information.
If I replace <match>(.*)</match> it will send the full event text.
In both situation it will send the message twice.
What am I doing wrong?

]]>https://forum.netxms.org/topic/2849/event-log-parsingRSS for NodeFri, 13 Nov 2026 14:55:03 GMTWed, 15 Jan 2014 08:31:17 GMT60<![CDATA[Reply to Event Log parsing on Fri, 17 Jan 2014 12:59:17 GMT]]>Once again thanks a lot.
It's working like a charm.

]]>https://forum.netxms.org/post/12487https://forum.netxms.org/post/12487Fri, 17 Jan 2014 12:59:17 GMT<![CDATA[Reply to Event Log parsing on Fri, 17 Jan 2014 12:34:17 GMT]]>Hi!

You should replace * with parser's name. By default parser name is file name (given in <file>), but you can override it with name attribute, like this:

<parser name="AppLog">
  <file>*Application</file>
  <rules>
    <rule>
      <severity>6</severity>
      <match>(SQL Server Scheduled Job)*(Message: The job failed)*</match>
      <event params="1">100025</event>
    </rule>
  </rules>
</parser>

and then use LogWatch.Parser.MatchedRecords(AppLog)

Best regards,
Victor

]]>https://forum.netxms.org/post/12485https://forum.netxms.org/post/12485Fri, 17 Jan 2014 12:34:17 GMT<![CDATA[Reply to Event Log parsing on Fri, 17 Jan 2014 12:05:36 GMT]]>Thanks, it worked!
Now I have another issue with establishing a counter for the matched records and displayed in a dashboard.
I think the parameter I need is LogWatch.Parser.MatchedRecords(*) .
Simply placing this parameter in Data Collection Configuration dose not work
What do I need to replace * with in order to run correctly?

]]>https://forum.netxms.org/post/12484https://forum.netxms.org/post/12484Fri, 17 Jan 2014 12:05:36 GMT<![CDATA[Reply to Event Log parsing on Wed, 15 Jan 2014 13:26:26 GMT]]>Hi!

It probably should be something like this:

<match>(SQL Server Scheduled Job.*Message: The job failed.*)</match>

if you want to capture full text but match only messages with certain words in it.

Best regards,
Victor

]]>https://forum.netxms.org/post/12466https://forum.netxms.org/post/12466Wed, 15 Jan 2014 13:26:26 GMT