PIKT Log Scan Macro

piktlog_scan(A, B1, B2)
 
	init
		status =piktstatus
		level =piktlevel
		task "Scan the PIKT (A).log for noteworthy entries"
		input logfile "=logdir/(A).log"
	begin	
		=checkpoint(=lalim)

		// assume no crisis (yet)
		set #crisis = #false()
#if dbserver | prodserver
		// on production servers, only process non-emergency pikt
		// log files in the early morning, during production downtime
		if $alert() !~~ "red|emergency"
			if #hour() > 5
				quit
			fi
		fi
#endif

	rule	// automatic bypasses	
		if    $inlin =~~ "==> =logdir/.+ <=="
			next
		endif

	rule	// special alarm-specific bypasses, first bypass
		if $inlin =~~ "(B1)"
			next
		endif

	rule	// bypass empty lines
		if ! #length($inlin)
			next
		endif

	rule
		=set_hr($inlin)

	rule	// report ERROR entries
		if $inlin =~ "ERROR]"
			output mail $inlin
			next
		endif

	rule	// report inactive alarms
		if    $inlin =~ "INFO].+suspended status"
		// && =monday
			output mail $inlin
			next
		endif


	rule	// report stderr output from invoked commands
		if =notlogmsg
			if $inlin !~~ "broken pipe"
				output mail $inlin
			endif
			next
		endif

	rule	// report corrupted lines, then bypass
		if #hr == #err()
			output mail $inlin
			next
		endif

	rule	// report entries due to a possibly badly formed input
		// command that results in no input
		if    $inlin =~ "WARNING].+no input data"
			=outputmail $inlin
			next
		endif

	rule	// bypass commonplace stuff
		if $inlin =~ "(DEBUG]|NOTICE]|INFO]|
                              last line is improperly date/time-stamped|
                              no answer from)"
			next
		endif

	rule	// special alarm-specific bypasses, second bypass
		if $inlin =~~ "(B2)"
			next
		endif

	rule	// possibly report WARNING entries
		if $inlin =~ "WARNING]"
			=outputmail $inlin
			next
		endif

	rule	// report anything not filtered out
		output mail $inlin

	end
		if #crisis
			// =page()
		endif
		quit