Article Content
Article Number | 000031710 |
Applies To |
|
Issue | 1 - Oracle WebLogic server sometimes split logs intoto two lines with EOL as LF for each. #### Audit Record Begin <05.07.2012 9:31:38> <Severity =INFORMATION> <<<Event Type = RoleManager Audit Event ><Subject: 0 LF 2 - In /etc/netwitness/ng/logcollection/content/collection/file/oracleweblogic.xml the delimiter found is #### content="%OracleWebLogicAR-4: #### Audit Record Begin <<<hfld1> <hfld2>, <hfld3> <hfld4> <hfld5>> <<Severity =<hfld6>> <<<<<<Event Type = <messageid> <hfld7>> <!payload:hfld1>" /> |
Cause | - Oracle WLS logs are sometimes modified into different formats other than the standard. |
Resolution |
cat /tmp/file1 | sed -n -e "H;\${g;s/\n//g;p}" | sed 's/End ####/End ####\n/g' | sed 's/\tPrincipal/ Principal/g' |
Notes |
|