Differences
This shows you the differences between two versions of the page.
| ardiextra:logfile [2023/11/28 02:30] – created optrix | ardiextra:logfile [2025/12/18 22:50] (current) – external edit 127.0.0.1 | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| + | ====Log File Events==== | ||
| + | ===Information=== | ||
| + | |||
| + | Turns log files into source of ARDI events. | ||
| + | |||
| + | ^Driver Info^Detail^ | ||
| + | |Driver Type: | ||
| + | |Platforms: | ||
| + | |||
| + | ===Driver Settings=== | ||
| + | |||
| + | ^Option^Description^ | ||
| + | |Log File|The full path to the log file. Must be accessible from the ARDI server| | ||
| + | |Regex|The Python-style regular expression used to extract information from each line of the log| | ||
| + | |Time Format|The format of any time-stamp in the log. See the Python [[https:// | ||
| + | |Timezone|The timezone of the data in the log file| | ||
| + | |||
| + | ===Named Groups & Regex=== | ||
| + | |||
| + | You can use named groups in your regular expression to capture information from logs. In Python-style regular expressions, | ||
| + | |||
| + | You can include the following group names... | ||
| + | |||
| + | ^Group Name^Usage^ | ||
| + | |Name|Used as the name of the event| | ||
| + | |Start|The start time for the event. The ONLY time if there' | ||
| + | |End|The end time for the event.| | ||
| + | |||
| + | ===Examples=== | ||
| + | |||
| + | ==CEF== | ||
| + | |||
| + | For example, a **CEF**-format log looks like this... | ||
| + | |||
| + | < | ||
| + | 127.0.0.1 - frank [10/ | ||
| + | </ | ||
| + | |||
| + | And if we wanted to mark this as an event, with the name of the resource as the title and the date as the start, we'd use the following expression... | ||
| + | |||
| + | **Regular Expression** | ||
| + | < | ||
| + | \[(? | ||
| + | </ | ||
| + | |||
| + | **Time Format** | ||
| + | < | ||
| + | %d/ | ||
| + | </ | ||
| + | |||
| + | ===Equipment=== | ||
| + | |||
| + | Most equipment logs don't keep to a specific standard, but will look something like the example below... | ||
| + | |||
| + | < | ||
| + | 2018-10-25 11: | ||
| + | </ | ||
| + | |||
| + | To read these in as a log entry, we'd use the following... | ||
| + | |||
| + | **Regular Expression** | ||
| + | < | ||
| + | (? | ||
| + | </ | ||
| + | |||
| + | **Time Format** | ||
| + | < | ||
| + | %Y-%m-%d %H:%M:%S | ||
| + | </ | ||