/usr/share/logsparser/normalizers/VMWare_ESX4-ESXi4.xml is in python-logsparser 0.4-1.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 | <?xml version="1.0" encoding="UTF-8"?>
<!--++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++-->
<!-- -->
<!-- pylogparser - Logs parsers python library -->
<!-- Copyright (C) 2011 Wallix Inc. -->
<!-- -->
<!--++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++-->
<!-- -->
<!-- This package is free software; you can redistribute -->
<!-- it and/or modify it under the terms of the GNU Lesser -->
<!-- General Public License as published by the Free Software -->
<!-- Foundation; either version 2.1 of the License, or (at -->
<!-- your option) any later version. -->
<!-- -->
<!-- This package is distributed in the hope that it will be -->
<!-- useful, but WITHOUT ANY WARRANTY; without even the implied -->
<!-- warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -->
<!-- PURPOSE. See the GNU Lesser General Public License for -->
<!-- more details. -->
<!-- -->
<!-- You should have received a copy of the GNU Lesser General -->
<!-- Public License along with this package; if not, write -->
<!-- to the Free Software Foundation, Inc., 59 Temple Place, -->
<!-- Suite 330, Boston, MA 02111-1307 USA -->
<!-- -->
<!--++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++-->
<!DOCTYPE normalizer SYSTEM "normalizer.dtd">
<normalizer name="VMWare_ESX4-ESXi4"
version="0.99"
unicode="yes"
ignorecase="yes"
matchtype= "match"
appliedTo= "raw"
taxonomy="hypervisor">
<description>
<localized_desc language="en">This normalizer parses VMware ESX 4.x and ESXi 4.x logs that are not handled by the Syslog normalizer.</localized_desc>
<localized_desc language="fr">Ce normaliseur analyse les logs de VMware ESX 4.x et ESXi 4.x. qui ne sont pas gérés pas le normaliseur Syslog.</localized_desc>
</description>
<authors>
<author>clo@wallix.com</author>
</authors>
<tagTypes>
<tagType name="date" type="datetime">
<description>
<localized_desc language="en">Expression matching a date in the format yyyy-mm-dd hh:mm:ss.</localized_desc>
<localized_desc language="fr">Expression correspondant à une date au format yyyy-mm-dd hh:mm:ss.</localized_desc>
</description>
<regexp>\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}.\d{3}</regexp>
</tagType>
<tagType name="hexa_num" type="integer">
<description>
<localized_desc language="en">Expression matching a hexadecimal number.</localized_desc>
<localized_desc language="fr">Expression correspondant à un nombre héxadécimal.</localized_desc>
</description>
<regexp>[A-F0-9]{8}</regexp>
</tagType>
<tagType name="alpha_words" type="basestring">
<description>
<localized_desc language="en">Expression matching the 'alpha' field, words between '.</localized_desc>
<localized_desc language="fr">Expression correspondant au champ 'alpha', qui contient les mots entre '.</localized_desc>
</description>
<regexp>[^']+(?: [^']+)*</regexp>
</tagType>
<tagType name="level_word" type="basestring">
<description>
<localized_desc language="en">Expression matching the 'level' field.</localized_desc>
<localized_desc language="fr">Expression correspondant au champ 'level'.</localized_desc>
</description>
<regexp>[^\s]+</regexp>
</tagType>
</tagTypes>
<patterns>
<pattern name="VMWare-001">
<description>
<localized_desc language="en">Logs contained in hostd.log file.</localized_desc>
<localized_desc language="fr">Logs contenus dans le fichier hostd.log.</localized_desc>
</description>
<text>\[DATE NUMERIC LEVEL 'ALPHA'[^\]]*\] BODY</text>
<tags>
<tag name="__date" tagType="date">
<description>
<localized_desc language="en">The time at which the request was issued - please note that the timezone information is not carried over.</localized_desc>
<localized_desc language="fr">La date à laquelle la requête a été émise. Veuillez noter que l'information de fuseau horaire n'est pas prise en compte.</localized_desc>
</description>
<substitute>DATE</substitute>
<callbacks>
<callback>YYYY-MM-DD hh:mm:ss</callback>
</callbacks>
</tag>
<tag name="numeric" tagType="hexa_num">
<description>
<localized_desc language="en"></localized_desc>
<localized_desc language="fr"></localized_desc>
</description>
<substitute>NUMERIC</substitute>
</tag>
<tag name="level" tagType="level_word">
<description>
<localized_desc language="en">The level is the type of the log.</localized_desc>
<localized_desc language="fr">Le level correspond au type du log.</localized_desc>
</description>
<substitute>LEVEL</substitute>
</tag>
<tag name="alpha" tagType="alpha_words">
<description>
<localized_desc language="en"></localized_desc>
<localized_desc language="fr"></localized_desc>
</description>
<substitute>ALPHA</substitute>
</tag>
<tag name="body" tagType="Anything">
<description>
<localized_desc language="en">The actual event message.</localized_desc>
<localized_desc language="fr">Le message décrivant l'événement.</localized_desc>
</description>
<substitute>BODY</substitute>
</tag>
</tags>
<examples>
<example>
<text>[2011-09-05 17:03:15.220 F6F74B90 verbose 'App'] [VpxaMoVm::CheckMoVm] did not find a VM with ID 67 in the vmList</text>
<expectedTags>
<expectedTag name="numeric">F6F74B90</expectedTag>
<expectedTag name="level">verbose</expectedTag>
<expectedTag name="alpha">App</expectedTag>
<expectedTag name="body">[VpxaMoVm::CheckMoVm] did not find a VM with ID 67 in the vmList</expectedTag>
<expectedTag name="taxonomy">hypervisor</expectedTag>
</expectedTags>
</example>
<example>
<text>[2011-09-05 17:19:21.741 F63E6900 info 'Vmomi' opID=996867CC-0000030B] Throw vmodl.fault.RequestCanceled</text>
<expectedTags>
<expectedTag name="numeric">F63E6900</expectedTag>
<expectedTag name="level">info</expectedTag>
<expectedTag name="alpha">Vmomi</expectedTag>
<expectedTag name="body">Throw vmodl.fault.RequestCanceled</expectedTag>
<expectedTag name="taxonomy">hypervisor</expectedTag>
</expectedTags>
</example>
</examples>
</pattern>
<pattern name="VMWare-002">
<description>
<localized_desc language="en">Logs contained in sysboot.log file.</localized_desc>
<localized_desc language="fr">Log contenu dans le fichier sysboot.log.</localized_desc>
</description>
<text>sysboot: EVENT</text>
<tags>
<tag name="body" tagType="Anything">
<description>
<localized_desc language="en">The actual event message.</localized_desc>
<localized_desc language="fr">Le message décrivant l'événement.</localized_desc>
</description>
<substitute>EVENT</substitute>
</tag>
</tags>
<examples>
<example>
<text>sysboot: Executing 'esxcfg-init --set-boot-progress done'</text>
<expectedTags>
<expectedTag name="body">Executing 'esxcfg-init --set-boot-progress done'</expectedTag>
<expectedTag name="taxonomy">hypervisor</expectedTag>
</expectedTags>
</example>
</examples>
</pattern>
</patterns>
</normalizer>
|