IV33948: NEED THE SYNTAX TO STRIP OFF THE JSON FORMATED HEADER IN THE SOCKET PROBE HEADER AND FOOTER OPTION.

APAR status

• Closed as documentation error.

Error description

• There needs to be documentation on how to strip off JSON
  formated events hitting the port that the socket probe is
  listening on.  The current docs does not mention anything about
  double escaping characters.
  
  
  Double-escaping is what is needed in the probe's props file. So
  it would be like this:
  
  
  Header                        :       "\\\{EVENT\\\:\\\{"
  
  Footer                        :       "\\\}\\\}"
  
  
  The code that reads configuration escapes once, so the regular
  expressions passed to libOpl and the regex library would be
  "\{EVENT\:\{" and "\}\}", which are valid and match for literal
  curly braces and colon characters.
  

Local fix

• sent instructions to customer
  

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * All users of the IBM Tivoli Netcool/OMNIbus Socket Probe.    *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * Additional information is required to describe how to use    *
  * escape characters when specifying the headers and footers    *
  * that mark the start and end of each event.                   *
  ****************************************************************
  * RECOMMENDATION:                                              *
  * The product documentation will be updated and released at    *
  * the end of the current release cycle.                        *
  ****************************************************************
  

Problem conclusion

• The following topic will be added to the Socket Probe Reference
  Guide.
  
  
  Using double escape characters when specifying event headers and
  footers
  ----------------------------------------------------------------
  ----------------------
  If the headers or footers of the events that the probe receives
  contain escape characters, you will need to use double escaping
  characters in the Header and Footer properties.
  
  For example, if the probe receives events in JSON format, you
  should set the Header and Footer properties in the socket.props
  file as follows:
  
  Header : "\\\{EVENT\\\:\\\{"
  Footer : "\\\}\\\}"
  
  The code that reads the configuration file escapes once, so the
  regular expressions passed to Netcool/OMNIbus would be
  "\{EVENT\:\{" and "\}\}", which match for the literal curly
  braces and colon characters.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Publications Referenced

SC23793107

Fix information

Applicable component levels