How can I report on all of those thousands of BEA- messages in our weblogic logs?

[Rob_Jordan]

How can I report on all of those thousands of BEA- messages in our weblogic logs?

[Rob_Jordan · Accepted solution]

These searches will extract BEA- messages from the logs and report by message number

Example of a BEA Message:

####<Jan 1, 2009 2:34:07 PM CDT> <Error> <WebLogicServer> <hostname> <managedserver> <[ACTIVE] ExecuteThread: '8' for queue: 'weblogic.kernel.Default (self-tuning)'> <<WLS Kernel>> <> <> <1273606447204> <BEA-000337> <[STUCK] ExecuteThread: '3' for queue: 'weblogic.kernel.Default (self-tuning)' has been busy for "715" seconds working on the request

Use a regular expression to extract a custom field called BEA_MSG_NO

"<BEA-"|rex field=_raw "(?<BEA_MSG_NO>BEA-\d\d\d\d\d\d)"|stats count by BEA_MSG_NO

"<BEA-"|rex field=_raw "(?<BEA_MSG_NO>BEA-\d\d\d\d\d\d)"|timechart count by BEA_MSG_NO

"<BEA-"|rex field=_raw "(?<BEA_MSG_NO>BEA-\d\d\d\d\d\d)"|top BEA_MSG_NO limit=10000

NOTE: if you prefix your search with the sourcetype for your weblogic logs, your results should come back much faster.

sourcetype="*weblogic.out*" "<BEA-"|rex field=_raw "(?<BEA_MSG_NO>BEA-\d\d\d\d\d\d)"|stats count by BEA_MSG_NO

sourcetype="*weblogic.out*" "<BEA-"|rex field=_raw "(?<BEA_MSG_NO>BEA-\d\d\d\d\d\d)"|timechart count by BEA_MSG_NO

sourcetype="*weblogic.out*" "<BEA-"|rex field=_raw "(?<BEA_MSG_NO>BEA-\d\d\d\d\d\d)"|top BEA_MSG_NO limit=10000