Using PERL's power to analyze backup logs


For those who use ComputerAssociates ARCServe for NT to backup personal workstations, one of the good things is the detailed job log that is produced. If there is a problem with a backup, I can research the logs to uncover the problem. The most common problem is that the jobs miss personal computer agents on a regular basis. Since I backup several hundred PCs and the jobs can miss anywhere from five to twenty agents, it is not practical for me to read the entire log every day and search for the missed agents. The only thing I want to do is see a list of PC agents that were missed so I can look into the problem.

A section of the PC job log looks like this:
ARCserve for Windows NT -- Backup

E8511 Failed to connect with client agent. (ADDRESS=0.0.0.0 (QA_EDN))
E8511 Failed to connect with client agent. (ADDRESS=0.0.0.0 (QA_TLH))
E8511 Failed to connect with client agent. (ADDRESS=0.0.0.0 (QA_ADR))
E8511 Failed to connect with client agent. (ADDRESS=0.0.0.0 (QA_BMR))
E8511 Failed to connect with client agent. (ADDRESS=0.0.0.0 (QA_JMK))

Job ID.................. 3
Workstation............. QA_SFV ( 0.0.0.0 )
Source.................. C:
Target.................. FRIDAY, ID 8D58, Sequence #1
Session................. 1
Start Time.............. 5/28/99 8:30 AM
Total Directories....... 386
Total Files............. 6,065
Total Skips............. 0
Total Size (Disk)....... 152.60 MB
Total Size (Media)...... 164.68 MB
Elapsed Time............ 10m 12s
Average Throughput...... 16.14 MB/min

E8511 Failed to connect with client agent. (ADDRESS=0.0.0.0 (QA_TP1))
E8511 Failed to connect with client agent. (ADDRESS=0.0.0.0 (QA_DJS))

Job ID.................. 3
Workstation............. QA_WRF ( 0.0.0.0 )
Source.................. C:
Target.................. FRIDAY, ID 8D58, Sequence #1
Session................. 2
Start Time.............. 5/28/99 8:41 AM
Total Directories....... 235
Total Files............. 3,131
Total Skips............. 0
Total Size (Disk)....... 114.48 MB
Total Size (Media)...... 120.81 MB
Elapsed Time............ 9m 33s
Average Throughput...... 12.65 MB/min

E8511 Failed to connect with client agent. (ADDRESS=0.0.0.0 (QA_ABH))
E8511 Failed to connect with client agent. (ADDRESS=0.0.0.0 (QA_ALG))
And it goes on like that for pages. The lines that begin with "E8511" are missed agents, the more detailed sections that start with "Job ID..." are the agents that were backed up. the six character codes that start with "QA_" are the names of the computers. What I want is a list of those computer names that were not backed-up. I wrote a PERL script which takes the detailed log and produces this list in a file called FAILED.TXT:
QA_BXS
QA_CFT
QA_DLK
QA_ELG
QA_JXR
QA_RTM
QA_BLN
QA_BXG
QA_CGR
QA_DJW
QA_DMO
agents were missed on 5/19/99

...............................
Much easier and faster to read.
The PERL script I wrote does several things:
1. Opens the original log
2. Searches for the error code "E8511"
3. If a line start with that code it takes that line and cuts out everything except the computer name.
4. Copies each captured computer name and passes it to a file called FAILED.TXT
Here is the code:
#!/usr/local/bin/perl
#Log Scanner for ACRserve
#Version 1.3
#February, 1999
print "PC Backup Log Scanner for ACRserve Ver 1.3";
print "\nCreated by Olaf 2/1/99";

print "\n\nWhat log do you want to scan? ";

$file = ;

open(LOGFILE, "$file");
open(OUTFILE, ">>failed.txt");
$key = "Start";
$error = "E8511"; print OUTFILE "\n...............................\n";


while(){

$aline = $_;
($first, $rest)= split(' ', $aline);
if($first eq $key){
($s, $t, $date)= split(' ', $aline);
}
if($first eq $error){
($r0, $r1, $r2, $r3, $r4, $r5, $r6, $r7, $r8)= split(' ', $aline);
($p1, $more)= split('\(',$r8);
chop ($more); chop ($more);
print OUTFILE "\n$more";
print "\n$more";
}

}
print OUTFILE "\nagents were missed on $date\n";
print "\nagents were missed on $date\n";
close(ERRORLOG);
close(LOGFILE);

Compare with the C++ version here.