IBM Enterprise Console - Manual (Page 160)

Using the system log message from the preceding September 29 example, the
component specifiers and matches are as follows:
%t Sep 29 14:57:28
%s aspen
su: ’su su: ’su
%s root
succeeded for
succeeded for
%s jsmith
on on
%s /dev/ttypd
The white space characters that separate the words of a system log message must
also be present in the format string. A single space character (that is, one blank) in
the format string will match any number of white space characters in the message.
For example, if the space between the colon (:) and the quotation mark (’) is
deleted in the preceding specialized format string, as shown in the following
example, the system log message would no longer match it.
%t %s su:’su %s’ succeeded for %s on %s
Care should be taken when using the arbitrary length repeater component
specifiers (%s* and *s+). The following format string does not make much sense:
This is not a good format %s* %s*
The first %s* matches everything through the end of the message, and the second
%s*
never matches anything. It might appear that this does not matter, but the
importance is apparent as discussed in “Mappings” on page 149.
The following format string, however, is meaningful:
This is a good format %s* : %s*
The first %s* matches everything up to the first colon (:), and the second %s* now
matches everything through the end of the message.
The format string must also reflect whether white space precedes a constant or
component specifier. In the following example, both messages match a format
string of %s*company_xyz because they are preceded by zero (0) or more
constants and no white space.
company_xyz is logging messages
Acompany_xyz is logging messages
However, the following example requires a format string with a space after the
%s*
component specifier, as in %s* company_xyz, because it is preceded by white
space and does not match the previous format string.
the company_xyz is logging messages
From the preceding examples, you can see that you can specialize a generic format
string to match a more specific event by either replacing component specifiers with
constants or by restricting the arbitrary length repeater specifiers to a fixed length,
using constants to complete the specifier.
148 IBM Tivoli Enterprise Console: Adapters Guide