Next: Notify Up: Message Log Previous: Change Log

Flatten - Reading the Message Log

The program flatten formats the message log file to allow it to be more easily read and processed by a database management system or by operating system utilities (sed, awk, etc.). Flatten resides in the directory /usr/adm/sg. It reads the free format records found in the Eagle log, reformats the records in a fixed field format, and prints them on standard output. When completed, it prints on standard error the number of records skipped due to badly formed log messages.

In the output, each field is of variable width and is separated from the next by one space. The last field is terminated by a newline (ASCII linefeed). The description of the fields below are given in the same order as they appear in the output.

date
The date of the log message is given in the form MM/DD/YYYY, so that August 1, 1995 will show up as 08/01/1995.

time
The time of the log message is given in 24-hour clock style in the form HH:MM:SS. Example, 08:15:01.

service or program
This tells what generated the message. If the ID (described next) is zero, this is a program like gwcontrol or passer. If ID is non-zero, it is a service like ftp or telnet.

ID
This is the identification number of a connection if non-zero. If zero, the message does not describe a connection.

message level
This tells at what severity level this message is. Values are: Info, Notice, Warning, Error, Alert, Critical, Emergency, or Unknown. Refer to Appendix for a description of these severity codes.

message id
This gives the unique message id number that every message in the Eagle log file has. Example: 101 for Eagle Network Security Management System starting up. See Appendix for a description of log messages.
argument 1
argument 2
argument 3
argument 4
argument 5
These five fields are variable parts of the log message broken out into separate values. The values are different for each separate message. An argument that is not used by the message will have a value of 0, in order to keep the same number of fields on an output line. Only the following message id's have any arguments:

105
a1=incoming host, a2=outgoing host
106
a1=traced host
201
a1=incoming host, a2=outgoing host
310
a1=host name, a2=host IP address
311
a1=host name
312
a1=host name
406
a1=audio file name
417
a1=host name, a2=port number
501
a1=incoming host, a2=outgoing host
502
a1=host name, a2=ethernet address
503
a1=host name, a2=host IP address
605
a1=program name

log message (optional)
This field contains the entire text of the log message as specified by ID. Note this field has a variable length and may contain spaces. It is terminated with Newline character (ASCII Linefeed). Use -n as a command line argument to exclude this field from the flattened record.



Next: Notify Up: Message Log Previous: Change Log


tkevans@delmarva.com