This chapter describes the following:
Applications generate messages in many different formats. Log Central stores messages in its database in one format. It also stores message definitions. Message definitions provide static information about messages that may be generated by various applications. Such information might include recommendations for how to respond to specific errors. Message definitions can be viewed within the Log Central Console with the Message Details window of the Message Browser. For more information about the Message Browser, refer to Chapter 9, "Using the Log Central Console."
Message definitions provide information about probable causes or suggest corrective actions in response to received messages. Two fields in the Log Central message format-Description and Recommendation-are provided for this purpose. You can access this information from the Log Central Console by invoking the Message Browser Message Details window, as described in Chapter 9, "Using the Log Central Console," or by exporting message definitions to a file, as described in this chapter in "Exporting Message Definitions." This information is stored in the message type definitions in the Log Central database.
Message definitions are provided out-of-the-box for BEA TUXEDO applications, Oracle Host Log, and NT eventlog messages. Utilities, which are described in this chapter, are provided to add message definitions for other resources you wish to manage. The Message Definition Editor of the Log Central Console can also be used to update these fields. This facility allows users to update probable cause or recommended action fields in light of their experience.
To get message definitions into the Log Central database, you perform the following two steps:
Message Definitions
Getting Message Definitions into the Log Central Database
You can also modify or create message definitions one at a time through the GUI. How to do this is described in Chapter 9, "Using the Log Central Console."
To create a message definition file, perform one of the following two actions:
install_dir/etc/msgdef.template) supplied with Log Central.
The remainder of this section provides details.
A message definition file contains one or more message definitions, each of which consists of up to 10 fields. Two of those fields, The subsystem and message ID are used to correlate incoming messages in the Log Central database with their corresponding message definitions. Thus, when a message with a particular subsystem and message ID arrives, you can display its corresponding message definition.
Two of the fields, Other fields are optional. If a particular field appears in one message definition, but not in succeeding definitions, the value of that field is inherited by message definitions that follow. Each message definition is enclosed within a pair of braces ( The message definitions are stored in an ASCII text file. You can either construct your own file, following the structure and rules of the template supplied with Log Central, or copy the template and then edit it to your specifications. The template is found in The fields of a message definition are shown in the following table in the order in which they appear in the message definition file.
A sample message definition might look like the one following this paragraph. This definition includes all of the possible fields. Its subsystem is Once you have constructed your own message definition file, you load it into the Log Central database by entering the following command at the command-line prompt:
where:
Description of Message Definition File
SUBSYSTEM and SEVERITY, must appear in the first message definition, and can optionally appear in succeeding definitions. If they are not specified in any definition after the first, their values are inherited from the last definition in which they were specified. Severity is an important attribute of a message. The severity of a message is a rating used to represent the importance or impact of an event. For example, a message that indicates high usage of a print spooler reports a less severe event than a message telling you that an application server has crashed. The Log Central Central Collector assigns a severity to messages as it saves the message in the Log Central database or to generate SNMP traps. When the Log Central Console displays messages in its Message Browser, the messages are typically colored depending on their severity. If you want the same subsystem and severity to apply to all message definitions, you can specify these values only in the first definition. Typically, though, you would assign a different severity to each message definition, and thus would repeat this field for each message definition. Alternatively, you could group message definitions by severity, so as to preclude having to repeat the same severity for each definition in a group.
MESSAGE_ID and SUMMARY, must appear in every message definition. The message ID uniquely identifies a message definition, while the message summary gives it contextual identity.
{}).
install_dir/etc/msgdef.template. If you use the template, you must edit all constructs following equals signs because the constructs specified in the template file are just descriptive placeholders.
Fields of a Message Definition File
Example
TUXEDO, its MESSAGE_ID=1206, its severity is Critical. The summary, description, and recommendation are as shown. When the Central Collector loads a message of ID 1206 and subsystem TUXEDO, the file sendalert.exe is executed. This could, for example, send an alert to the system administrator. Whenever a message matching this MESSAGE_ID and subsystem appears, Log Central issues an SNMP TRAP_ID=47. The message is also automatically marked as acknowledged.
{
SUBSYSTEM = TUXEDO
MESSAGE_ID = 1206
SUMMARY = Memory allocation failed for compression
SEVERITY = Critical
DESCRIPTION = An attempt dynamically to allocate memory from the\
operating system failed while compressing a message.
RECOMMENDATION = Make sure the operating system parameters are set\
correctly for the amount of memory on the machine and the amount of memory that\
can be used by a process. Reduce the memory usage on the machine or increase\
the amount of physical memory on the machine.
EXECUTE_ON_UPLOAD = C:\bin\sendalert.exe
TRAP_ID = 47
TRAP_ENABLED = Yes
AUTO_ACKNOWLEDGE = Yes
} Load the Message Definition File
msgdef_import [-f
filename] [-inifile inifilename]
filename
inifilename
msg_processor.ini is used. The initialization file is described in detail in Appendix F, "Initialization File."
There are also command-line utilities that enable you to export message definitions from the Log Central database to an ASCII text file and delete selected message definitions.
You can export message definitions from the database to an ASCII text file with the msgdef_export command at the command-line prompt. The exported data is written to a file in the format described in "Create a Message Definition File." To export message definitions, use the following command at the command-line prompt:
msgdef_export [-ffilename][-ssubsystem_name[-ssubsystem_name...]] [-inifileinifilename]
msgdef_import [-ffilename][-inifileinifilename]
where:
filename
subsystem_name
inifilename
msg_processor.ini is used. The initialization file is described in detail in Appendix F, "Initialization File."
You can delete the message definitions specified in the message definition file from the Log Central database with the msgdef_delete and subsystem_delete commands at the command-line prompt. If you want to delete a group of message definitions you loaded previously, you could use the same message definition file you used with the msgdef_import command. If you want to delete a group of message definitions that belong to a specific subsystem, use the subsystem_delete command.
You can delete a list of message definitions by using the following command:
msgdef_delete [-ffilename][-inifileinifilename]
where:
filename
inifilename
msg_processor.ini is used. The initialization file is described in detail in Appendix F, "Initialization File."
You might use this command to delete the message definitions you just loaded with msgdef_import.
You can delete all the message definitions associated with a particular subsystem, as well as the subsystem name entry. To do so, use the following command:
subsystem_delete -ssubsystemname[subsystem_name]
where:
filename
subsystem_name