How to Extract All Logged Lines Related Only to a Single Probe From Mid Server Logs - Support and Troubleshooting

How to Extract All Logged Lines Related Only to a Single Probe From Mid Server Logs Summary .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } When Troubleshooting Discovery Probes, Orchestration Probes, Integration Probes, or any other issue where an ECC Queue Output record was created and processed by MID Server, there are often times we want to see just the logged lines for that Probe. However these log lines are often broken apart by logs from other probes and processes running concurrently on the MID Server making it more difficult analyze just the logs we need to see. In other use cases a Regulated Market or Self-Hosted customer may have internal restrictions for uploading an entire MID Server log file for Support to review. Being able to extract only the lines related to the issue and write them to a new log file that can be uploaded the case help speed up the resolution to an issue.

This Article provides both Windows and UNIX/Linux commands that match only on the lines belonging to the Probe being investigated. These commands will also extract carriage separated 'new' lines after a match is found so that elements like Stack Traces and Discovery Pattern logs which are usually missing from output of more common commands such as grep.

Facts .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } }

Commands to extract logs related to a probe from the MID Server log file and export them to a new log file

On a UNIX/Linux system you can use the following command:

awk '/^[0-9]{4}-[0-9]{2}-[0-9]{2}.* / {print; in_block=1; next} /^[0-9]{4}-[0-9]{2}-[0-9]{2}/ {in_block=0} in_block' input.txt > output.txt

On a Windows system you can use the following PowerShell command:

$inBlock=$false; Get-Content input.txt | ForEach-Object { if ($_ -match '^\d{4}-\d{2}-\d{2}.* ') { $inBlock=$true; $_ } elseif ($inBlock -and ($_ -notmatch '^\d{4}-\d{2}-\d{2}')) { $_ } else { $inBlock=$false } } | Set-Content output.txt

Commands to extract logs related to a probe from the MID Server log file and print them to the terminal:

On a UNIX/Linux system you can use the following command:

awk '/^[0-9]{4}-[0-9]{2}-[0-9]{2}.* / {print; in_block=1; next} /^[0-9]{4}-[0-9]{2}-[0-9]{2}/ {in_block=0} in_block' input.txt

On a Windows system you can use the following PowerShell command:

$inBlock=$false; Get-Content input.txt | ForEach-Object { if ($_ -match '^\d{4}-\d{2}-\d{2}.* ') { $inBlock=$true; $_ } elseif ($inBlock -and ($_ -notmatch '^\d{4}-\d{2}-\d{2}')) { $_ } else { $inBlock=$false } }

Release .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Any Release

Instructions .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } 1. Reproduce the issue.

2. Find and copy the Sys Id of the ECC Queue Output record that was created and picked up the MID Server.

3. Download the agent logs from the MID Server.

4. In the Command to extract the logs.

- Replace with the Sys ID of the ECC Queue Output record.

- Replace input.txt with the name of the MID Server log file.

- Replace output.txt with the name of the file you want to export the logs to.

5. Run the command.