The event messages are internally stored in event log as message bodies containing references to some message source specific DLL returning the actual text for these references. The Event Viewer, when displaying such messages, dynamically loads the registered message source DLL and uses it to expand the references. On contrary, the LogSearchEx simply returns whatever is available in the body of the message. It doesn't attempt to load any additional DLLs and expand the references. That's why you cannot see these parts in the returned result and the messages appear to be truncated.
One solution for this issue is to use the 24x7 Event Server and make it monitor event logs and have needed records saved into text files which later can be read and parsed in 24x7 Scheduler jobs. The 24x7 Event Server can also invoke jobs automatically when required messages are found in logs.
: Hi,
: When I'm using LogSearchEx like this: LogSearchEx FALSE, "12/28/2006
: 0:00:00","Transformation Server (ORACLE)", v_events
: I got this in v_events: 97 INFO 01/04/2007 03:21:19 Transformation Server
: (ORACLE) APISAR1 N/A RFSHBI at 03:21:19
: 227 INFO 01/04/2007 03:21:19 Transformation Server (ORACLE) APISAR1 N/A
: SAR_F56407Z1 SAR F56407Z1 FW72PDSRV
: 324 INFO 01/04/2007 03:21:19 Transformation Server (ORACLE) APISAR1 N/A
: SAR_F56407Z1 SAR F56407Z1 FW72PDSRV 17334909 0
: The description is trucated and should be: 97 should be: Transformation
: Server Update process ended for source system RFSHBI2 at 09:47:53.
: 227 should be: Refresh completed for table SAR.SAR_F56TMRAT. The rows in the
: table which originated from table F56TMRAT in library OSACIDTA have been
: refreshed.
: 324 should be: 8137855 rows inserted, 0 rows not inserted into table
: SAR.SAR_F56TMRAT during a table refresh operation. Source table was table
: F56TMRAT in library OSACIDTA
: Please could you help?
: Thanks.
|
