WebSphere Application Server Insight Pack

A WebSphere® Application Server Insight® Pack is provided with IBM® Operations Analytics Log Analysis.

The Insight Pack includes support for ingesting and performing metadata searches against the following WebSphere Application Server V7 and V8 log files:
  • SystemOut.log
  • SystemErr.log
  • trace.log

This document describes the version of the WebSphere Application Server Insight Pack that is installed when you install IBM Operations Analytics Log Analysis. An updated version of the WebSphere Application Server Insight Pack may have been published after this version of IBM Operations Analytics Log Analysis. To download the latest versions of this Insight Pack as well as updated documentation, see IT Operations Management: Insight Packs.

Configuration artifacts

The Insight Pack supports the WebSphere Application Server timestamp format MM/dd/yy HH:mm:ss:SSS Z.

The timestamp format can be changed in the Data Sources workspace.
  1. Open an existing WebSphere Application Server source type, then click View Index Configuration.
  2. Select all of the text and copy it to the clipboard.
  3. Create a new source type, and click Edit Index Configuration.
  4. Paste the original index configuration into the editor, then modify the dateFormats field of the timestamp entry.
  5. Fill in the remaining source type fields and click OK. Next, create a new collection that uses the source type you just created.
Note: Data sources are not predefined. A user with administrator privileges must define at least one WebSphere Application Server data source before the application can be used.
The following table lists the configuration artifacts that are provided with the Insight Pack for each log file.
Table 1. Insight Pack configuration artifacts
  SystemOut.log SystemErr.log trace.log
Splitter WASJavaSplitter WASSystemErr-Split WASTrace-Split
Annotator WASJavaAnnotator WASSystemErr-Annotate WASTrace-Annotate
Source type WASSystemOut WASSystemErr WASTrace
Collection WASSystemOut-Collection1 WASSystemErr-Collection1 WASTrace-Collection1
Note: The Splitter and Annotator for SystemOut.log use Java™. The Splitters and Annotators for SystemErr.log and trace.log use the Annotation Query Language (AQL).

Log File Agent configuration

The supported log files share IBM Tivoli® Monitoring Log File Agent (LFA) configuration files. The following LFA configuration files are in the Log_Analytics_install_dir/IBM-LFA-6.30/config/lo directory:
  • WASInsightPack-lfawas.conf: Configuration file for the WAS log file agent.
  • WASInsightPack-lfawas.fmt: Matches records for the WAS log files.

Splitting and annotation AQL modules

Splitting and annotation are handled by the following Annotation Query Language (AQL) modules.
Table 2. Insight Pack AQL modules
AQL Module Description
common Common code module that is used across most WebSphere Application Server log files (for example, to recognize timestamp formats).
annotatorCommon Common annotations module that is used for all WebSphere Application Server log files.
annotatorSystemOut Annotator module for the trace.log file.
annotatorSystemErr Annotator module for SystemErr.log files.
splitterWAS Splitter module for SystemErr.log files.