Sed Cleans It Up
Figure 1 also shows a lot of redundant data. It would be nice to strip that out so that we get only unique data for the event, so let's use Sed to eliminate everything in the message except the client and the username. A quick inspection reveals that we can easily remove some strings (e.g., substitute them with a value of nothing) by having the tool identify matches, as follows:
- Remove the word "Client" and the space that follows it
- Remove the string of text beginning with "successfully" and ending with "mailbox," as well as the extra spaces before and after
- Remove the text that follows the mailbox name, beginning with the period and leading into "For more information ..."
When you're using Sed to find matches, it doesn't matter exactly what strings you look for. For example, you could look for "mailbox," or even "box." It's merely important to pick a string with enough characters so that Sed can match the string in exactly the right place and in no other.
Now, build these matches as regular expressions. The trickiest regular expression is the final one, in which we remove the tail of the message ID to get rid of the "For more information" text, as well as the punctuation around it. The regular expression
"s/\. For.{0,}$//"
matches the string beginning with ". For" and continuing to the end of the line (denoted by the regular expression character $) and substitutes the matching string with nothing, effectively eliminating the text. The period (.) is a wildcard, so don't forget to escape the character with a backslash (\). Also, because we're looking for a space, we need to enclose the entire command in quotes.
The other two regular expressions are easy. You could pipe the output from one Sed command into another, but it's more elegant to combine your substitutions using braces and separating with semicolons, as follows:
sed -r "{s/\Client //;
s/\suc.{0,}box // ; s/\.
For.{0,}$//"}
Running this through the entire command, we get much tighter output as Figure 2 shows.
Automate!
Now that we've got the output pared down to something useful, we can configure the command to run weekly and mail the results to an administrator. First, we instruct LogParser to obtain only the previous week's data. To do so, we modify the WHERE clause so that the SELECT statement looks for TimeGenerated values that are less than 1 week old, as follows:
WHERE TimeGenerated >
SUB(SYSTEM_
TIMESTAMP(), TIMESTAMP( '08',
'dd' ) )
This function returns any events that are newer than (i.e., greater than) the present time minus (SUB) 8 days (dd). Now, go to Control Panel and create a new scheduled task by opening the Scheduled Tasks applet and choosing Add Scheduled Task. Save the entire command into a batch file and specify that it run once per week.
Finally, edit the batch file to email the results to an administrator. You can write your own email script, using Collaboration Data Objects (CDO) to generate an email message, or you can use a tool such as Blat, which uses a Win32 program to send an SMTP message for you. If you choose to script it yourself, include an option to accept data from a stream so that you can pipe the output to the script.
Now, Tweak It
I've shared one example of distilling a common event into usable data and exporting it to another system. Even if you don't use POP3/IMAP, you can easily tweak aspects of this example for any event that's important to your systems.
Register
