CPars.exe
Description
This program provides access to the BMC Defender Server parsing functions. The program can be used as a simple filter, reading standard input, and outputting parsed values. The function accepts multiple expressions in the form of keyword matches, field positions, and more complex $parse functions. See documentation on BMC Defender parsing functions for detailed information.
Usage and Syntax
[ ("pfun2") [ ("pfun3") ...]]
Also: cpars.exe -file (infile) [ (opts) ] "(pfun1)"
[ ("pfun2") [ ("pfun3") ...]]
Opts: -file (infile)
Opts: -sep ("delimstr")
Opts: -maxcount (count)
Opts: -analyze
Arguments
(opts) | This argument is one or more of the command options. Zero or more options can be specified. (See options as follows.) |
-file | This argument, if it exists, is the input file to process. The input file must be followed by a valid (infile) argument, that is the pathname of the file to process. If this option is omitted, the CPars program reads standard input and writes the matched results to standard output. |
(infile) | This argument must follow the -infile argument, and is the full or relative pathname of the file to process. |
-sep | This argument, if it exists, is a character (or phrase, enclosed in double quotes.) This separates the parsed values that are output by the program. |
-maxcount (or –max) | This argument, if it exists, is the number of lines to parse and output. The default number of lines to parse is 0x7FFFFFFF (if no –maxcount option is specified). |
(count) | This argument must follow the -maxcount argument, and can be any integer number ranging from 1 to the maximum integer size for the system. |
-analyze. | This argument, if it exists, changes the mode of the program to output a tabulated occurrence count of matched values, showing the number of times the parse function result occurred in the input, similar to the Analyze function of the server. (See the CLyze.exe function for additional information.) |
(pfun1) | This is a parse function, including a value such as $1 for the first word of input, $2 for the second word of the input, and more. It might also be a match pattern such as user name: * (that returns the space delimited string following the user name). It might also be a complex (possibly nested) BMC Defender parse function such as $message(1, 20). |
(pfunN) | The first parse function can be followed by other parse functions to a maximum of around 255 functions each parse function is applied and the output (if any) in the message is returned to standard output. |
Application
The CPars.exe program is commonly used as the final step of a pipeline, necessary to parse the message into fields for reporting. The program accepts as input a raw list of messages (such as that produced by the Cat functions described elsewhere.)
The program accepts one or more parse specifications, that can be used to extract part of the message by field number, by context, or by a special $parse() functions. This provides a huge amount of power in targeting the particular fields of the message. (See the CO-PARSE.pdf manual for detailed information on parse expressions.)
Specifically, parse specifications can consist of:
- Numeric word positions such as $1, $2, $99.
- Match expressions such as user: *, and this - *.
- Parse functions such as $url(http://*) and $geo($12).
- Nested composite specifications such as $basename($url($8).
Each parse specification should be enclosed in double-quotes if it contains spaces. Each parse specification is executed, and the parsed result (consisting of a single word or a string) is output separated by whatever string or character has been specified with the optional -sep argument. At least one parse specification is required, but multiple parse specifications can be used.
Related topic