IBM Enterprise Console manual su ’su su ’su, succeeded for succeeded for, on on

Using the system log message from the preceding September 29 example, the component specifiers and matches are as follows:

%t Sep 29 14:57:28

%s aspen

su: ’su su: ’su

%s root

succeeded for succeeded for

%s jsmith

on on

%s /dev/ttypd

The white space characters that separate the words of a system log message must also be present in the format string. A single space character (that is, one blank) in the format string will match any number of white space characters in the message. For example, if the space between the colon (:) and the quotation mark (’) is deleted in the preceding specialized format string, as shown in the following example, the system log message would no longer match it.

%t %s su:’su %s’ succeeded for %s on %s

Care should be taken when using the arbitrary length repeater component specifiers (%s* and *s+). The following format string does not make much sense:

This is not a good format %s* %s*

The first %s* matches everything through the end of the message, and the second %s* never matches anything. It might appear that this does not matter, but the importance is apparent as discussed in “Mappings” on page 149.

The following format string, however, is meaningful:

This is a good format %s* : %s*

The first %s* matches everything up to the first colon (:), and the second %s* now matches everything through the end of the message.

The format string must also reflect whether white space precedes a constant or component specifier. In the following example, both messages match a format string of %s*company_xyz because they are preceded by zero (0) or more constants and no white space.

company_xyz is logging messages Acompany_xyz is logging messages

However, the following example requires a format string with a space after the %s* component specifier, as in %s* company_xyz, because it is preceded by white space and does not match the previous format string.

the company_xyz is logging messages

From the preceding examples, you can see that you can specialize a generic format string to match a more specific event by either replacing component specifiers with constants or by restricting the arbitrary length repeater specifiers to a fixed length, using constants to complete the specifier.

148IBM Tivoli Enterprise Console: Adapters Guide