eels_log_import(1Meels)
eels_log_import --
insert rows into an EELS database from a log import script
Synopsis
eels_log_import -o field_order [-d database_name] [-r record_delimiter]
[-f field_delimiter] [-t table_name] [-z trace_level]
eels_log_import -l
eels_log_import -L
Description
The eels_log_import command is used by log
import scripts to insert records in the EELS
database. Users with the appropriate database privileges
can also import records into the EELS database
using this command. eels_log_import works in two
modes, in the first mode, records are imported directly
into the database without passing through the EELS
driver, the second mode, the records are passed through the
driver for some basic processing. This basic processing
includes the assignment of unique event Ids that are essential
for maintaining the integrity of an EELS database.
The direct mode of operation is available for some of the
standard EELS commands such as
eels_log_restore(1Meels).
For more information see the -d option described below.
The input data stream for eels_log_import must
consist of fields and records delimited by field and record
delimiter characters; these delimiter characters are
specified on the command line. If either
of the delimiters appears in a field's text, the log import
script (that produces the input stream) must escape them
using the escape character ``\''. If the
escape character itself appears in the field's text,
is must also be escaped, by using a double escape
(``\\'').
NOTE:
The ``EELSUser'' configuration block must be defined in
eels_config(4eels),
and an RTLSP process must be running before you
can use eels_log_import. For more information, see the
``Log sources'' in Enhanced Event Logging System
topic.
This command also provides the -l and -L
options that enable scripts to list the field names within
the events table.
Options
-d database_name-
Specify the destination database name where the data stream
should be imported. Using this option bypasses the EELS
driver and as such is discouraged. Under normal circumstances
you should avoid using the -d option, in which case
your records are first passed through the filter attached
to the ``EELSUser'' log message source and then imported
into the database and table specified by the associated
data sink. For more information on filters and data sinks, see
eels_config(4eels).
-f field_delimiter-
The character the log import script uses to delimit fields
in the input stream. The default is the UNIX pipe
symbol ``|''.
-l-
List all the field names (one per line) in the events table to
standard output.
-L-
List all the field names (separated by a space) in the events
table to standard output.
-o field_order-
A space separated list of field names that specify the order
of the fields within the input stream generated by the log import
script.
-r record_delimiter-
The character the log import script uses to delimit records
in the input stream. The default is the newline character
``\n''.
-t table_name-
Specify a destination table name to import the
data stream into. The table you specify must have
been created previously using
eels_db_admin(1Meels).
The default table name is ``events''.
-z trace_level-
Print debugging information. Valid debugging levels are
``1'' for minimal logging to ``4'' for full logging.
Examples
myscript /var/tmp/mylog | \
eels_log_import -o "ProcessID, LogSystemSource, \
TimeOffset, EventSpecificInformation"
This example shows a script myscript
that reads records from a proprietary log file
/var/tmp/mylog, and prints them to
standard out in the order specified by the -o
option. The fields are delimited by the default
character ``|'' and the records by the
default character ``\n''. Since no
-d or -t options were specified,
the records were passed to the ``EELSUser''
RTLSP process for filtering and logging. For
example, if /etc/default/eels contained the
following configuration blocks:
real-time-import EELSUser {
EELSUser default;
filter EELSUser_filter;
}
log-destination default {
database defaultdb;
table events;
}
filter EELSUser_filter {
include "EventSpecificInformation ~ 'error'";
exclude "EventSpecificInformation == '*'";
}
The records would first be filtered using the
``EELSUser_filter'' block (only include messages that
contain the word ``error'' in the
EventSpecificInformation field).
Any records that pass through the filter will be imported
into a database called defaultdb and a table
called ``events''.
References
eels_db_admin(1Meels),
eels_config(4eels)
© 2004 The SCO Group, Inc. All rights reserved.
UnixWare 7 Release 7.1.4 - 25 April 2004