Ibm mq 使用Splunk解析IBM MQ v9.1错误日志
我正在使用splunk forwarder将我的IBM MQ v9.1错误日志转发到一个集中集群,以查看在我的分布式消息传递系统中发生的常见错误的趋势 但是,我无法解析所需字段,因为MQ错误日志的格式是不同的,即消息的严重性可能是错误、警告、信息、严重和终止,并且每个消息本身具有不同的字段集,并且不一致 请告诉我是否有人在splunk中使用regex来解析v9.1的IBM MQ错误日志字段 我尝试了一些正则表达式模式,但并没有像预期的那样进行解析 我已经提到了下面的链接,但这是针对v8的,v9的错误日志格式不同, splunk用户也无法访问错误日志。我已经在qm.ini中更新了下面的小节 文件系统: ValidateAuth=否 还将chmod-R 755设置为/var/mqm/qmgrs/qmName/errors文件夹 尽管错误日志的权限不会在每次更新时更改,但当日志循环时,权限将被吊销,并且splunk用户无法读取日志Ibm mq 使用Splunk解析IBM MQ v9.1错误日志,ibm-mq,splunk,Ibm Mq,Splunk,我正在使用splunk forwarder将我的IBM MQ v9.1错误日志转发到一个集中集群,以查看在我的分布式消息传递系统中发生的常见错误的趋势 但是,我无法解析所需字段,因为MQ错误日志的格式是不同的,即消息的严重性可能是错误、警告、信息、严重和终止,并且每个消息本身具有不同的字段集,并且不一致 请告诉我是否有人在splunk中使用regex来解析v9.1的IBM MQ错误日志字段 我尝试了一些正则表达式模式,但并没有像预期的那样进行解析 我已经提到了下面的链接,但这是针对v8的,v9的
请让我知道如何克服这个问题,而不将splunk用户添加到mqm组我建议启用JSON日志并将这些日志转发给splunk,splunk应该能够解析此格式 在IBM MQ v9.0.4 CDS发行版中,IBM添加了注销到JSON格式日志的功能,即使启用JSON日志记录,MQ也将始终记录到原始AMQERR0x.log文件。这包括在所有MQ 9.1 LTS和CSD版本中 IBM MQ v9.1知识中心页面包含有关此主题的信息。您可以将以下内容添加到
qm.ini
中,使其将日志信息输出到标准队列管理器errors
目录中名为AMQERR0x.JSON
的JSON格式文件中:
正如OP所指出的,JSON格式的日志不包含您在正常日志中看到的解释
或操作
部分
在IBM MQ v9.1中,您可以使用
mqrc
命令将JSON格式转换为您在AMQERR01.LOG
中看到的熟悉格式
下面是一个简单的例子:
cat <<EOL |mqrc -i json -o text -
{"ibm_messageId":"AMQ9209E","ibm_arithInsert1":0,"ibm_arithInsert2":0,"ibm_commentInsert1":"localhost (127.0.0.1)","ibm_commentInsert2":"TCP/IP","ibm_commentInsert3":"SYSTEM.DEF.SVRCONN","ibm_datetime":"2018-02-22T06:54:53.942Z","ibm_serverName":"QM1","type":"mq_log","host":"0df0ce19c711","loglevel":"ERROR","module":"amqccita.c:4214","ibm_sequence":"1519282493_947814358","ibm_remoteHost":"127.0.0.1","ibm_qmgrId":"QM1_2018-02-13_10.49.57","ibm_processId":4927,"ibm_threadId":4,"ibm_version":"9.1.0.5","ibm_processName":"amqrmppa","ibm_userName":"johndoe","ibm_installationName":"Installation1","ibm_installationDir":"/opt/mqm","message":"AMQ9209E: Connection to host 'localhost (127.0.0.1)' for channel 'SYSTEM.DEF.SVRCONN' closed."}
EOL
536908297 0x20009209 rrcE_CONNECTION_CLOSED
536908297 0x20009209 urcMS_CONN_CLOSED
MESSAGE:
Connection to host 'localhost (127.0.0.1)' for channel 'SYSTEM.DEF.SVRCONN'
closed.
EXPLANATION:
An error occurred receiving data from 'localhost (127.0.0.1)' over TCP/IP. The
connection to the remote host has unexpectedly terminated.
The channel name is 'SYSTEM.DEF.SVRCONN'; in some cases it cannot be determined
and so is shown as '????'.
ACTION:
Tell the systems administrator.
您还可以使用
mqrc
,只使用来自JSON的错误消息,例如AMQ9209E
,您可以这样运行命令:
mqrc AMQ9209E
输出将是:
02/22/2018 06:54:53 AM - User(johndoe) Program(amqrmppa)
Host(0df0ce19c711) Installation(Installation1)
VRMF(9.1.0.5) QMgr(QM1)
Time(2018-02-22T11:54:53.942Z)
RemoteHost(127.0.0.1)
CommentInsert1(localhost (127.0.0.1))
CommentInsert2(TCP/IP)
CommentInsert3(SYSTEM.DEF.SVRCONN)
AMQ9209E: Connection to host 'localhost (127.0.0.1)' for channel
'SYSTEM.DEF.SVRCONN' closed.
EXPLANATION:
An error occurred receiving data from 'localhost (127.0.0.1)' over TCP/IP. The
connection to the remote host has unexpectedly terminated.
The channel name is 'SYSTEM.DEF.SVRCONN'; in some cases it cannot be determined
and so is shown as '????'.
ACTION:
Tell the systems administrator.
----- amqccita.c : 4214 -------------------------------------------------------
536908297 0x20009209 rrcE_CONNECTION_CLOSED
536908297 0x20009209 urcMS_CONN_CLOSED
MESSAGE:
Connection to host '<insert one>' for channel '<insert three>' closed.
EXPLANATION:
An error occurred receiving data from '<insert one>' over <insert two>. The
connection to the remote host has unexpectedly terminated.
The channel name is '<insert three>'; in some cases it cannot be determined and
so is shown as '????'.
ACTION:
Tell the systems administrator.
在下面的命令中,每个ibm\u arthInsert
都指定了一个继续-n
标志,依次是每个ibm\u commentInsert
和一个继续-c
标志:
mqrc AMQ9209E -n 0 -n 0 -c "localhost (127.0.0.1)" -c "TCP/IP" -c "SYSTEM.DEF.SVRCONN"
结果如下:
cat <<EOL |mqrc -i json -o text -
{"ibm_messageId":"AMQ9209E","ibm_arithInsert1":0,"ibm_arithInsert2":0,"ibm_commentInsert1":"localhost (127.0.0.1)","ibm_commentInsert2":"TCP/IP","ibm_commentInsert3":"SYSTEM.DEF.SVRCONN","ibm_datetime":"2018-02-22T06:54:53.942Z","ibm_serverName":"QM1","type":"mq_log","host":"0df0ce19c711","loglevel":"ERROR","module":"amqccita.c:4214","ibm_sequence":"1519282493_947814358","ibm_remoteHost":"127.0.0.1","ibm_qmgrId":"QM1_2018-02-13_10.49.57","ibm_processId":4927,"ibm_threadId":4,"ibm_version":"9.1.0.5","ibm_processName":"amqrmppa","ibm_userName":"johndoe","ibm_installationName":"Installation1","ibm_installationDir":"/opt/mqm","message":"AMQ9209E: Connection to host 'localhost (127.0.0.1)' for channel 'SYSTEM.DEF.SVRCONN' closed."}
EOL
536908297 0x20009209 rrcE_CONNECTION_CLOSED
536908297 0x20009209 urcMS_CONN_CLOSED
MESSAGE:
Connection to host 'localhost (127.0.0.1)' for channel 'SYSTEM.DEF.SVRCONN'
closed.
EXPLANATION:
An error occurred receiving data from 'localhost (127.0.0.1)' over TCP/IP. The
connection to the remote host has unexpectedly terminated.
The channel name is 'SYSTEM.DEF.SVRCONN'; in some cases it cannot be determined
and so is shown as '????'.
ACTION:
Tell the systems administrator.
我建议您将MQ配置为登录JSON并将其转发给Splunk。它起作用了。但是,AMQERR01.json中没有显示AMQERR01.LOG中的解释和操作。我们有没有办法也能做到这一点?它不包括解释或行动,但所有关于这些的信息都包含在“插入”中。您可以使用IBM MQ v9.1
mqrc
命令获取解释和操作文本,或者在需要该信息时将json条目转换回旧的文本条目。我用几个示例命令更新了我的答案。如果您只是需要参考,完整的消息文本都记录在知识中心中-谢谢@JoshMc。我现在面临一个新问题。splunk用户无法访问错误日志。我已经在qm.ini文件系统中设置了下面的更新节:ValidateAuth=No还将chmod-R 755设置为errors文件夹。尽管错误日志的权限在日志轮换时每次更新时都不会更改,但权限会被吊销,并且splunk用户无法读取日志。请让我知道如何在不将splunk用户添加到mqm组的情况下克服此问题。如果这是同一问题的一部分,请编辑该问题并添加它。如果这是一个新问题,那么请提出一个新问题。