[Update] Format command syntax | เครื่องหมายโคลอน – NATAVIGUIDES

Monitoring, Version 6.2.2

A format command consists of two components:

• The log format description
• Data mapping and formatting specifications

Log format description

The format description is comprised of one or more scan directives
enclosed within double quotation marks (“…”). Generally,
a scan directive identifies a field or group of fields within a log
entry, although a directive can identify a single character within
a log entry. A field is any sequence of nonwhite space characters
terminated by one or more white space characters (that is, a tab or
blank).

For example, the sequence below consists of five fields:

Dec 25 2004 03:15 pm

In addition to fields with content that varies from one log entry
to another, an entry can contain fixed character strings that occur
in the same relative location in all log entries. These are termed
literals. Literals can be embedded anywhere within a format description.

A scan directive has the following format. (Items enclosed within
brackets are optional.)

%[(offset)][*][width][size]datatype

All scan directives must include at least a percent sign, ‘%’,
and a datatype.

Each scan directive starts from where the previous one ended unless
it is the first (in which case it starts at column 1 in the log entry),
or an offset option has been included in the directive. Each scan
directive consumes characters from a log entry until any of the following
occurs:

• An inappropriate character is encountered (that is, one that does
  not match the expected data type).
• The field width, if specified, is exhausted.
• The end of the log entry is encountered.

Format description components

The following sections describe each of the format description
components. To simplify the discussion, all examples in the next section
include only the relevant scan directives from a format description.
The corresponding mapping specifications that must be included in
a complete format command have been omitted.

Literals

Literals describe a sequence of one or more characters that occur
at the same relative location in every entry in the log, and which
you do not want to map into a table view column.

Specifying a literal makes the monitoring agent look for and read those
characters from a log entry, and then discard them. If you include
a literal, it must match exactly the character sequence in a log entry,
otherwise that entry is ignored.

For example, to read a time from a log that has the format:

03:15

The following scan directives can be used:

 %d:%d

In this example, the colon ‘:’ preceding the second directive
is a literal.

Any number of white space characters that immediately precede the
start of a field in a log entry are automatically consumed and discarded
(unless the data type of the next scan directive is a character, for
example %c). To consume any number of white space characters that
are embedded within a literal in a log entry, include one or more
white space characters in the format description literal. For example,
suppose a log entry has the following format:

MSG123 < Code 9 > System1

If you want to extract only the message field, the code number,
and the system, use the following format description:

%s < Code%d >%s

The first directive scans in the message field. The single blank
following the first directive consumes all the white space between
the message field and the ‘<‘ sign in the log entry. Similarly,
the single blank between the ‘<‘ sign and the literal ‘Code’
in the format description consumes all the white space between those
same literals within the log entry. No white space is required between
the literal ‘Code’ and the ‘%d’ directive or between
the literal ‘>’ and the ‘%s’ directive because this
white space is automatically consumed.

To include a percent sign, ‘%’, in a literal, specify
two adjacent percent sign characters in the format description. For
example, if you want to extract the percentages from a log that contains
the following three fields:

45% 82% 2%

Use the following format description:

%d%% %d%% %d%%

(The blanks embedded within the description are not required but
clarify the example.)

Offsets

Offsets allow you to specify the absolute column within a log entry
at which a scan directive starts; if no offset is specified, each
succeeding scan starts where the previous one ended. The first column
in an entry is 1. Offsets can facilitate the description of fixed
field logs; that is, those in which a field starts in the same column
in every entry.

For example, suppose each log entry starts with a message number
as in the following example:

MSG123 Dec 25

If you want to extract only the message number, discarding the
text “MSG” that precedes it, you can use the following scan
directive:

%(4)d

This causes the scan to start in column 4, skipping over and discarding
the first three characters.

Field suppression

The character ‘*’ in a scan directive indicates that the
scanned data is suppressed. That is, the data is read from the log
entry but discarded. For example, suppose a log entry has the following
form:

MSG123 Dec 25

If you want to skip over the message number field entirely, you
can use this format description:

%*s %s %d

These directives cause the message number field to be ignored but
the month and day are stored and mapped to a column. Since the data
is discarded for scan directives that are suppressed, such directives
have no corresponding data mapping specifier (which associates log
data with a table view column).

Width

The width option allows you to specify the maximum number of characters
that is consumed from a log entry to satisfy a scan directive. For
example, suppose you want to extract only the first 2 digits from
the message number from the following log entry:

MSG123 Dec 25

You can use the following scan directives:

%*3s %2d %*d

The first directive, “%*3s”, discards the first three
characters of the message number field (the text “MSG”).
The second directive, “%2d”, saves the digits “12″
for mapping and the last directive, “%*d”, discards any digits
that remain in the message field. The digit ‘3’ is consumed
and discarded.

For scan directives that have a data type of “string”
(that is, %s or %[]), the default width is 31.

Size

The size option can be used in numeric (that is, non-string) directives
and controls the amount of storage that is reserved to hold a scanned
number. Allocating more storage allows larger numbers to be scanned
and stored. Unless you need to scan very large numbers or need to
increase the precision, the default sizes are probably sufficient.
The effect of including a size option in a numeric scan directive
depends on the operating system on which the monitoring agent is run.

The valid size option and data type combinations that you can specify
are listed in the following table.

Table 6. Monitoring Agent for UNIX Logs valid size option and data type combinations

Size option
Can be used with these data types

l
d, i, o, u, x, e, f, g

ll
d, i, o, u, x

L
e, f, g

h
d, i, o, u, x

If you explicitly include formatting in the data mapping specifier
for a scanned value rather than allowing the print directive to default,
the size option that you specify in the scan and print directives
must be consistent.

Data type

The data type of a scan directive indicates whether the corresponding
characters in the log entry are alphanumeric or numeric and affects
how the data is stored by the monitoring agent once it has been scanned. Specifying
that log data is numeric instead of a simple alphanumeric string can
simplify the format description and allows the scanned data to be
converted (for instance, displayed in hexadecimal or scientific notation
instead of decimal), as it is being mapped into a table view column.

The following table lists the valid data types you can use in a
scan directive to describe alphanumeric data.

Table 7. Monitoring Agent for UNIX Logs valid alphanumeric data types

Data type
Corresponding field in the log entry

s

A sequence of nonwhite space characters.
Characters from the log entry are consumed until the first white space
character is encountered or until the number of characters specified
in the field width has been exhausted. If no width is specified in
the directive, the default width is 31.

c

A sequence of bytes. The number of bytes
consumed is determined by the specified width option. If no width
is specified, the default is 1. Unlike all other data type directives,
white space immediately preceding the corresponding field in the log
entry is not automatically skipped. To skip over white space, you
must explicitly include a white space literal immediately preceding
a directive with a data type of character.

This feature is useful
for describing fields in a log entry that might be blank assuming
the starting column and width of the optional field is known. For
example, suppose two entries from a log are as shown:

field1a field2a field3a
field1b field3b

Field 2, if present, always starts in
column 12 and can be up to 9 characters long. The following format
description could be used:

%s %(12)9c %s

In this example,
the second directive will store “field2a” when the first
entry is processed and will contain blank when the second entry is
processed.

[inclusive scanset] or [^exclusive scanset

Any sequence of characters. A scanset data
type is a generalized type ‘s’ (string) data type. In fact,
the type ‘s’ directive can be expressed by the following
exclusive scanset:

%[^ \t\n]

This says that all non-blank,
non-tab and non-newline characters will be consumed. That is, the
scan will end on the first white space character in the log entry.
(See Escape characters for details on specifying escape characters
in a format command.)

In an inclusive scanset, characters from
a log entry will be consumed until a character is encountered that
is not in the scanset. In an exclusive scanset (for example, one that
has a ‘^’ (circumflex) character immediately following the
left bracket), characters from a log entry will be consumed until
a character is encountered that is in the scanset.

A scanset
allows a single scan directive to consume multiple log entry fields.
For example, a scanset that you might use frequently is one that is
to “read all the remaining characters in an entry”:

%[^\n]

That
is, consume everything from the current position in an entry up to
the newline character, which marks the end of the entry.

A scanset
directive can also be used to terminate a scan before a simple type ‘s’
variable would, that is, when a white space character is found. For
example, suppose a log entry has embedded within it either one of
the following two field sequences:

Error code:24
Warning code:16

If you want only to extract the numeric
code itself, the following directives could be used:

%*[^:]:%d

This
format description consumes and discards (field is suppressed) all
characters until a colon is found (exclusive scanset), then consumes
and discards the colon itself (an embedded literal) and finally consumes
and stores the numeric code.

As with a string data type, if
you wish to consume more than 31 characters with a scanset directive,
you must include a maximum width option in the directive. For example,
to consume up to 60 characters from the current location up to the
end of the entry use:

%60[^\n]

Some operating systems
support the use of a ‘-‘ (dash) to represent a range of characters,
for example:

%[a-z]

This example includes all lowercase
letters in the scanset. The character that precedes the dash must
be lexically less than the character following it otherwise the dash
stands for itself. Also, the dash stands for itself whenever it is
the first or last character in the scanset.

To include the right
bracket in an inclusive scanset, it must immediately follow the opening
left bracket. To include the right bracket in an exclusive scanset,
it must immediately follow the circumflex character. In both cases,
a right bracket so placed is not considered the closing right bracket
of the scanset.

d, u

An optionally signed decimal integer.

i

An optionally signed integer with a base
determined by the first characters of the number:

• If the first character is in the range 1 to 9, the base is 10.
• If the first character is 0 and the second character is in the
  range 0 to 7, the base is 8.
• If the first 2 characters are 0x (or 0X), the base is assumed
  to be 16; that is, all characters in the range 0 to 9 and a to f (or
  A to F) are considered part of the number.

o

An optionally signed octal integer, that
is, a string of integers in the range 0 to 7.

x

An optionally signed hexadecimal integer,
that is, a string of characters in the range 0 to 9 and a to f or
A to F.

e,f,g

An optionally signed string of digits that
can contain a decimal point and/or an exponent component that consists
of an ‘E’ or an ‘e’ followed by an optionally signed
integer.

Data mapping specifications

The data mapping specifications that comprise the second component
of a format command are separated from the format description by a
single comma. Each mapping specification is separated from the next
by white space. Every non-suppressed scan directive in the format
description must have a single, corresponding data mapping specifier
to indicate into which column of the Log Entries table view the scanned
data must be mapped. That is, the general form of a format command
is as follows:

A , “%scan1 %scan2 %*scan3 %scan4" , mapspec1 mapspec2
mapspec4

The third scan directive has no corresponding mapping specifier
since it is suppressed (*).

As the data is mapped into a table view column you can also optionally
specify how you want it formatted and (for data read in and stored
in numeric form), that numeric data is converted to a different type
(for example, decimal to hexadecimal or exponent form). See Specifying log entry times for further details.

The columns into which scanned data can be mapped correspond to
columns in the Log Entries table view. The following table lists all
the valid column names and minimum abbreviations that can be used.

Table 8. Log entries table view column mapping names

Tivoli Enterprise Portal Log Entries table view column name
Format command mapping name
Minimum abbreviation

Entry Time
month
mo

day
da

year
ye

hour
ho

minute
mi

second
se

Description
description
de

Source
source
so

System
system
sy

Class
class
cl

Type
type
ty

Referring again to the example at the beginning of this section
(Example format command), notice that there are 10 scan directives
and also that there are 10 mapping specifications. Each successive
scan directive, reading the format description left to right, is associated
with each successive mapping specifier. That is, the first log entry
field, MSG123, is read by the first scan directive, %s, and is mapped
to the first column specifier, type. The second field, Dec, is read
by the second scan directive, %s, and is mapped to the second column
specifier, month, and so on.

As indicated in this same example, it is possible to concatenate
two or more non-adjacent log entry fields into the same table view
column. The log entry time is in 12-hour format; that is:

03:15 pm

The corresponding format description and data mapping specifiers
in the example format command are:

“%d:%d %s" , hour minute hour

This causes ’03’ to be read by the first scan directive, ‘%d’,
and mapped into the hour column. The next character in the log entry,
the colon, matches the colon literal in the format description and
is discarded. The ’15’ is read by the second scan directive, ‘%d’,
and is mapped into the minute column. The ‘pm’ is read by
the third scan directive, ‘%s’, and is also mapped into the
hour column. The result is that the hour and minute columns contain ‘3pm’
and ’15’ respectively. (If the monitoring agent is passed an hour
of ‘3pm’ it converts this into 24-hour format for display
in the Log Entries table view. See 12-Hour format times for
more information concerning valid date and time formats that can be
passed to the monitoring agent.)

The example above shows that it is necessary only to supply a column
name into which scanned log data is mapped. For each mapping specification
that has no explicit format specifier, default formatting is applied.
The monitoring agent expands the mapping specifiers in the previous example
as follows:

“%d:%d %s" , hour=“%d" minute=“%d" hour=“%s"

How to override the default mapping format specifiers is the subject
of the next section.

Formatting mapped data

If no formatting is included for a given mapping specification,
a default format specification is assigned based on the data type
and data type size in the corresponding scan directive. To specify
explicitly how scanned data is formatted as they are mapped into a
given column, follow the column map name with an equal sign (=) and
enclose your format specifier in double quotation marks (“…”).

The syntax for a data mapping specification that includes a format
specifier is as follows:

MappingName[=“[literals]%[options][width]
[.precision][size]datatype[literals]”]

The MappingName corresponds to one of the full or abbreviated names
from columns 2 and 3 of Table 8 and items in brackets
are optional. Since there is a one-to-one relationship between a scan
directive in the format description and a mapping specification, include
at most one “%datatype” directive in a mapping format specification.

Mapping format specifier components

The following paragraphs describe each of the mapping format specifier
components.

Literals

Literals can be included before the scanned data is mapped into
a table view column, afterwards, or both, and can serve to clarify
the Log Entries table view and facilitate the creation of situations.
For example, suppose you are monitoring a log that includes the following
three fields:

... 13303 15 4 ...

The first field indicates a process identifier, the second represents
a return code and the third a severity. You might choose to map and
format the data as follows:

“... %d %d %d ..." , ... source=“proc id. = %d" desc=“RC = %d " desc=“;
Severity = %d"...

(The ellipses represent omitted fields.) This causes the following
to be displayed in the source and description columns in the Log Entries
table view:

Source
Description

proc id. = 13303
RC = 15 : Severity = 4

To include a single % (percent sign) in a column, include two consecutive
% characters in the format specifier. For example, desc=“%d%%”
maps the integer 83 as “83%” into the description column.

Options

One or more options can be included in a mapping format specifier
although not all combinations are valid. The options and their meaning
are shown in the following table.

Table 9. Log Entries table view mapping options

Option
Description
Notes

‘

Formats integer portions for i, d, u, f,
g and G data types with the appropriate thousands grouping separator.

Effect depends on the locale setting on the
managed system. Use the locale -a command to view available locales
and review the monitoring agent log to determine the current locale.

–

Left-justifies data if number of characters
mapped is less than the minimum field width (see below).

Use with field width.

+

Inserts a ‘+’ or ‘-‘ sign
before a numeric value depending on whether it is greater or less
than zero.

Valid only for signed numeric data types.

space character

Inserts a space character before a positive
numeric value; inserts a ‘-‘ sign before a negative value.

Valid only for signed numeric data types.
Ignored if ‘+’ option is also specified.

#

For ‘o’ data type, increases precision
to force the first digit of the result to be a zero.

For ‘x’
and ‘X’ data types, precedes a nonzero result with ‘0x’
or ‘0X’ respectively.

For ‘e’, ‘E’, ‘f’, ‘g’
and ‘G’ data types, the result always contains a decimal
point even if no digits follow it. For ‘g’ and ‘G’
data types, trailing zeros are not removed from the result.

Not valid for c, d, s or u data types.

0

Pads to the field width with leading zeros.

Valid only for numeric data types. Ignored
if ‘-‘ option is also specified. Ignored also for d, i, o,
u, x and X data types if precision is specified.

For example, suppose a log entry contains the character sequence “65000″
and the format command contains:

“... %d ..." , ... type=“%'0+9d"

The type column is displayed as:

+0065,000

Width

A decimal digit string included in a mapping format specifier signifies
the minimum width of the field into which the data is mapped. If the
mapped data contains fewer characters than the minimum field width,
it is right justified and padded on the left to the length specified
by the field width. If the ‘-‘ (left-justify) option has
been specified, the data is padded on the right.

For example, suppose the log entry contains the following fields:

1 789 82 4567

You supplied the following format command:

A, “%d%d%d%d" , desc=“%8d" desc=“%8d" desc=“%8d" desc=“%8d"

The description column is formatted as follows:

1 789 82 4567

A field width with a leading zero is interpreted as meaning that
the field must be 0 padded.

Precision

A precision is specified by a [ . ] (dot) followed by a decimal
digit string. The effect of a precision depends on the type of data
being mapped.

Table 10. Mapping precision and the data types specified

Data type
Precision specifies

d, i, o, u, x, X

The minimum number of digits to appear

e, E, f

The number of digits to appear after the
decimal point

g, G

The maximum number of significant digits

strings

The maximum number of bytes to be printed
from a string

For example, suppose a log entry contains the following fields:

2 3.142857 123.45 On no account allow a vogon to read poetry at you

The format command is:

A,“%d%f%g%[^\n]" , de=“%.3d" de=“ %.3f" de=“ %.2g“ de=“ %.13s“

The description field contains the following:

002 3.143 1.2e+02 On no account

Size

The valid size options that you can specify in a format specification
for mapped data are the same as those that can be specified in a scan
directive in the log format description. See Table 6 for a list of valid size and data type combinations.

The data size specified in a mapping format specifier must be the
same as that specified in the corresponding scan directive.

Data type

As with the size option, the data type in a mapping format specifier
must be consistent with that in the corresponding scan directive.
This means that if data is scanned and stored as an integer, it must
be mapped as an integer. If it is scanned as a floating point number,
it must be mapped as a floating point number. If it is scanned as
a character or character string it must be mapped as a character or
character string.

Numeric data can be scanned and stored in one of two families:
the integer family and the floating point family. Within each family,
data can be represented in different ways. An integer can be displayed
in decimal, octal, hexadecimal and unsigned formats. A floating point
number can be displayed in decimal or exponent notation. When numeric
data is mapped, it is legal to use a different data type to that in
the scan directive as long as the format data type comes from the
same family. Put another way, it is not legal to mix data types from
different numeric families.

This feature allows you to perform type conversions as you map
data into a table view column to clarify the table view. For example,
if a field in a log entry contains the size of a file in bytes, you
can display the size as a hexadecimal value in the Log Entries table
view by using the following in the format command:

A, “... %d ..." , ... desc = “File size is %#x bytes" ...

If the file size is, for example, 11259375 bytes, the description
column will contain:

File size is 0xabcdef bytes

For an example that mixes data types from the floating point family,
the size can be displayed in exponent notation with the following
format command:

A, “... %f ..." , ... desc = “File size is %.2e bytes" ...

This time, the description column would contain:

File size is 1.13e+07 bytes

The valid mapping data types are specified by family in the following
tables.

Table 11. Integer family data types

Data type
Format of data scanned and stored as integers

d, i

Signed decimal numbers.

u

Unsigned decimal numbers.

o

Unsigned octal numbers.

x, X

Unsigned hexadecimal numbers. The letters
abcdef are used for x; the letters ABCDEF are used for X.

Table 12. Floating point family data types

Data type
Format of data scanned and stored as integers

f

Signed decimal numbers with the number of
digits after the decimal point equal to the precision. If no precision
is specified, the default is 6 digits.

e, E

In exponent form, that is, [-].ddd+/-dd.
One digit precedes the decimal point and the precision specifies the
number of digits that follow it. The default precision is 6. The E
data type produces a number with E instead of e before the exponent.

g, G

In either the f or g (G if E is used) formats,
depending on the value of the number with the precision specifying
the number of significant digits. The exponent form is used if the
exponent is less than -4 or greater than the precision.

c

As a single character. The mapped data can
have been read as a single character, ‘%c’, or could be the
first character of a string that was stored using a scan directive
such as ‘%s’, ‘%[]’, or ‘%nc’ (where n
is an integer field width).

s

As a string. The mapped data must have been
read and stored as a string using a scan directive such as ‘%s’, ‘%[]’,
or %nc’ (where n is an integer field width greater than 1). All
characters from the string are printed up to the number of bytes indicated
by the precision.

Escape characters

You might want to include characters in a format command that either
are not valid in the command itself (for example, the newline character),
or which have a special meaning to the monitoring agent when it is interpreting
the format command (for example, the double quote, “, character).
Such characters are represented in the format command by a sequence
of two characters:

• The backward slash (\) escape character
• Following the backward slash, a character that represents the
  character code that is being escaped

The backward slash character removes any special meaning from the
following character and causes the latter’s single character
code value to be substituted instead.

Escape characters can be included in three areas of a format command:

• In the format description
  • As part of a literal
  • Inside a scanset (%[]) type scan directive
• In a mapping specifier
  • As part of a literal

For example, suppose you want to monitor a log that contains the
following sample entry:

“http://www.acme.com" : GET /download/Acme.exe

Suppose that you want to extract the character string between the
set of double quotation marks and everything after the colon. Also,
assume you want to map the first string into the source column of
the Log Entries table view and that you want to map the second string
into the description column enclosing it in quotation marks. The following
format command accomplishes this:

A,"\"%[^\"]\" :%[^\n]" , source desc = “\"%s\""

Following the double quotation mark that starts the format description
is an escaped double quotation mark literal that consumes the double
quotation mark preceding “http:” in the sample log entry.
The exclusive scanset scan directive contains an escaped double quotation
mark that terminates the first scan; that is, “http://www.acme.com”
is stored by the scanset directive. The escaped double quotation mark,
white space character, and colon literal following the scanset directive
consumes all characters up to the text “GET” in the sample
log entry. The second scanset consumes and stores all characters until
a newline character is encountered (end of line). The next non-escaped
double quotation mark terminates the format description component
of the format command.

The mapping specification for the description column contains two
escaped double quotation mark literals surrounding the scanned string.

The following shows how the sample data above is displayed in the
Log Entries table view using this format command.

Description
Source

“GET /download/Acme.exe”
http://www.acme.com

The following table lists all the characters that can be represented
by an escape sequence and the associated escape sequence.

Table 13. Escape character sequence

Character
Escape sequence representation

newline
\n

horizontal tab
\t

vertical tab
\v

backspace
\b

carriage return
\r

backspace character (\)
\\

single quotation mark (‘)
\’

double quotation mark (“)
\”

alert
\a

Specifying log entry times

The entry time displayed in the Log Entries table view is extracted
from each log entry and is not the time at which the log monitor detected
the event. The format command that you supply for each user-defined
log must, therefore, include scanning and mapping specifications for
the entry time.

Since the format of dates and times varies so widely between logs,
the Entry Time column of the Log Entries table view is composed of
six components: the year, month, day, hour, minute, and second. You
specify scanning and mapping pairs explicitly for each component using
one of the mapping names in Table 8.

When the monitoring agent formats an entry from a log, it attempts to build
a timestamp with a format of:

mm/dd/yy hh:mm:ss

‘yy’ is the 2 digit year, the first ‘mm’ is the
month, ‘dd’ is the day of the month, ‘hh’ is the
hour (in 24-hour format), the second ‘mm’ is the minute and ‘ss’
is the second. To do so, the monitoring agent expects that the data that is
mapped into each of the entry time component fields is a valid integer.
The data type with which each component was scanned and mapped is
not important; what is important is that the formatted result is an
integer.

For example, suppose the date and time in a log entry is in the
form:

MSG123 2005 03 03 10 15 56 ...

Use the following format command to extract and map the entry time
components:

A , “%s %s %s %s %s %s %s" , desc year month day hour minute
second

The following format command is also valid:

A , “%s %d %d %d %d %d %d" , desc year month day hour minute
second

There are two exceptions to the requirement that all time components
consist of numeric data only: text months and 12-hour format times.

Text months

If the month of the log entry is in text form, for example, Jan,
Feb or JAN, FEB, you can read and map the month as a string. When
the monitoring agent is passed a month in this format, it will translate it
to the appropriate numeric value when constructing the entry time.

12-Hour format times

Some logs contain the entry time in 12-hour format, for example,
03:15 pm. Since the monitoring agent displays entry times in 24-hour format,
for such logs you must pass the ‘am/pm’ indicator to the monitoring agent in
the hour column. An example format command for reading and mapping
the hour and minute from a log with this format follows.

“%d:%d%s" , hour minute hour

This concatenates the ‘am/pm’ indicator to the 12-hour
value so that, using the previous time as an example, the value “3pm”
is passed to the monitoring agent. When constructing the entry time for an
event, the monitoring agent will translate such a time to its equivalent 24-hour
format, in this case ’15’.

Hardcoding missing entry time components

If you omit a scan or map specification pair for the seconds component
of the entry time, it will default to zero. If you omit a scan or
map pair for any of the other entry time components, the monitoring agent will
default the value to the corresponding current value reported by the
system clock both for real-time, monitored events and for events formatted
for a table view request (see the exception which follows for table
view requests if the omitted value is the year). This can be appropriate
for the purposes of monitoring but can lead to unpredictable or misleading
results for table view requests (which return all entries from a given
log that occurred within a certain time span).

If, for instance, the minute is not supplied within a log entry
and you do not want to let the minute default to the current system
clock minute for either monitored events or table view requests, you
can hardcode a value such as ‘0’ for the minute column. Suppose
an entry from such a log has the following format:

MSG123 2005 Mar 6 10 pm Text of event ...

The following format command will hardcode a value of zero for
the entry time minute for every event:

A,“%s %d %s %d %d %s%c %[^\n]" , de ye mo da ho ho min=“0"
desc=“:%s"

The Tivoli Enterprise Portal Log Entries table view would contain the following
in the Entry Time and Description columns. (If omitted, seconds defaults
to zero.)

Entry Time
Description

03/06/05 22:00:00
Text of event

To include a mapping specifier for the ‘minute’ column,
there must be an associated scan directive. However, we are trying
to hardcode a value of zero for this column; the data consumed by
the associated scan directive will not be used and is, therefore,
totally arbitrary.

In this example, a dummy scan directive is supplied ‘%c’
that consumes the single space character between the ‘pm’
and the start of the actual message. Since this space was going to
be discarded anyway and does not affect the data in interest, this
scan directive’s sole purpose is to allow the inclusion of a ‘minute’
column mapping specifier in which a ‘0’ character is forced
to be displayed.

Defaulting the year entry-time component

Many logs omit the year from their event entry times. For example,
the following sample was taken from a syslog.

Mar 17 03:34:11 frodo unix: NFS server gandalf not responding

When monitoring such logs, the monitoring agent sets the entry-time year
component for each new event to the current system-clock year as described
in Hardcoding missing entry time components.

When handling table view requests for logs that do not include
the entry-time year, the monitoring agent attempts to determine the year of
an event based on the date in the next entry. This causes the monitoring agent to
make an assumption that a monitored log has never been inactive for
a period one year or longer. To show how this works, suppose two entries
from a syslog are as follows. (New log entries are appended to the
end of the log so the entry dated December 31st is older than that
dated January 1st.)

Dec 31 23:34:11 bilbo unix: NFS server gandalf not responding
Jan 1 03:34:11 frodo unix: NFS write error on host bilbo

Further, suppose that the current date is March 15th, 2005. If
you issued a table view request and specified in the time span dialog
a time range of December 31st, 2004 at 11:00 p.m. to January 1st,
2005 at 4:00 a.m., the above entries are displayed (in reverse chronological
order) in the Log Entries table view as follows:

Entry Time
Description

01/01/05 03:34:11
NFS server gandalf not responding

12/31/04 23:34:11
NFS write error on host bilbo

[ Top of Page | Previous Page | Next Page | Contents | Index ]

Satzzeichen เครื่องหมายวรรคตอนภาษาเยอรมันDeutschภาษาอังกฤษZeichenตายAnführungszeichen 1
„ Gänsefüßchen” (“ เท้าห่าน”)เครื่องหมาย
คำพูด1 เครื่องหมายคำพูด (พ.ศ. )““die Anführungszeichen 2
“ chevron”“ französische“ (ภาษาฝรั่งเศส)เครื่องหมายคำพูด 2
“guillemets” ของฝรั่งเศส«»ตาย Auslassungspunkte

จุดไข่ปลาเครื่องหมาย ommission

…das Ausrufezeichenเครื่องหมายตกใจ!เดอร์อะพอสทรอฟเครื่องหมายวรรคตอน‘der Bindestrichยัติภังค์–der Doppelpunkt
das Kolonลำไส้ใหญ่:der Ergänzungsstrichเส้นประ–das Fragezeichenเครื่องหมายคำถามเหรอ?der Gedankenstrichเส้นประยาว–runde Klammernวงเล็บ (AE)
วงเล็บกลม (พ.ศ. )()Eckige Klammernวงเล็บ[]das Kommaลูกน้ำ,der Punktช่วงเวลา (AE)
หยุดเต็ม (พ.ศ. ).das Semikolonอัฒภาค;

หมายเหตุ:  ในหนังสือวารสารและสื่อสิ่งพิมพ์อื่น ๆ ของเยอรมันคุณจะเห็นเครื่องหมายคำพูดทั้งสองชนิด(ประเภท 1 หรือ 2) ในขณะที่หนังสือพิมพ์โดยทั่วไปใช้แบบที่ 1 แต่หนังสือสมัยใหม่จำนวนมากใช้เครื่องหมายแบบที่ 2 (ภาษาฝรั่งเศส)

 

ส่วนที่ 2: ความแตกต่าง

เครื่องหมายวรรคตอนภาษาเยอรมันกับภาษาอังกฤษ

ในกรณีส่วนใหญ่เครื่องหมายวรรคตอนภาษาเยอรมันและภาษาอังกฤษจะเหมือนกันหรือเหมือนกัน แต่ความแตกต่างที่สำคัญบางประการมีดังนี้

1. Anführungszeichen  (เครื่องหมายคำพูด)

A. ภาษาเยอรมันใช้เครื่องหมายคำพูดสองแบบในการพิมพ์ เครื่องหมายลักษณะ“ เชฟรอน” (“ guillemets” ของฝรั่งเศส) มักใช้ในหนังสือสมัยใหม่:

Er sagte: « Wir gehen am Dienstag »
หรือ
Er sagte: » Wir gehen am Dienstag «

ในการเขียนในหนังสือพิมพ์และในเอกสารสิ่งพิมพ์หลายฉบับภาษาเยอรมันยังใช้เครื่องหมายคำพูดที่คล้ายกับภาษาอังกฤษยกเว้นว่าเครื่องหมายคำพูดเปิดอยู่ด้านล่างแทนที่จะเป็นด้านบน: Er sagte:“ Wir gehen am Dienstag” (โปรดทราบว่าไม่เหมือนกับภาษาอังกฤษภาษาเยอรมันจะใช้เครื่องหมายคำพูดโดยตรงที่มีเครื่องหมายจุดคู่แทนเครื่องหมายจุลภาค

ในอีเมลทางเว็บและจดหมายที่เขียนด้วยมือผู้พูดภาษาเยอรมันในปัจจุบันมักใช้เครื่องหมายคำพูดสากล (“”) หรือแม้แต่เครื่องหมายคำพูดเดี่ยว (”)

B. เมื่อลงท้ายด้วยคำพูด “เขาพูด” หรือ “เธอถาม” ภาษาเยอรมันจะใช้เครื่องหมายวรรคตอนแบบอังกฤษ – อังกฤษโดยวางลูกน้ำไว้ด้านนอกของเครื่องหมายคำพูดแทนที่จะเป็นข้างในเช่นเดียวกับในภาษาอังกฤษแบบอเมริกัน: “Das war damals in Berlin” sagte Paul “ Kommst du mit?”, Fragte Luisa

C. ภาษาเยอรมันใช้เครื่องหมายคำพูดในบางกรณีที่ภาษาอังกฤษจะใช้  ตัวเอียง  ( Kursiv ) เครื่องหมายคำพูดใช้ในภาษาอังกฤษสำหรับชื่อบทกวีบทความเรื่องสั้นเพลงและรายการทีวี ภาษาเยอรมันขยายเป็นชื่อหนังสือนวนิยายภาพยนตร์ผลงานละครและชื่อของหนังสือพิมพ์หรือนิตยสารซึ่งจะเป็นตัวเอียง (หรือขีดเส้นใต้เป็นลายลักษณ์อักษร) ในภาษาอังกฤษ:
“Fiesta” (“The Sun also Rises”) ist ein Roman ฟอนเออร์เนสต์เฮมิงเวย์ – Ich las den Artikel “Die Arbeitslosigkeit in Deutschland” ใน der “Berliner Morgenpost”

D. ภาษาเยอรมันใช้เครื่องหมายคำพูดเดี่ยว ( halbe Anführungszeichen ) สำหรับใบเสนอราคาในใบเสนอราคาแบบเดียวกับที่ภาษาอังกฤษใช้:
“ Das ist eine Zeile aus Goethes, Erlkönig ‘”, sagte er

ดูรายการ 4B ด้านล่างสำหรับข้อมูลเพิ่มเติมเกี่ยวกับใบเสนอราคาเป็นภาษาเยอรมัน

2. อะพอสโทรฟี  ( Apostrophe )

ตอบโดยทั่วไปภาษาเยอรมันไม่ใช้เครื่องหมายอะพอสทรอฟีเพื่อแสดงการครอบครองสัมพันธการก ( Karls Haus, Marias Buch ) แต่มีข้อยกเว้นสำหรับกฎนี้เมื่อชื่อหรือคำนามลงท้ายด้วย s-sound (สะกด  -s, ss, -ß, -tz, -z, -x, -ce ) ในกรณีเช่นนี้แทนที่จะเพิ่ม s รูปแบบที่เป็นเจ้าของจะลงท้ายด้วยเครื่องหมายอะพอสทรอฟี:  Felix ‘Auto, Aristoteles’ Werke, Alice ‘Haus  – หมายเหตุ: ผู้พูดภาษาเยอรมันที่มีการศึกษาไม่ดีมีแนวโน้มที่ไม่ดีไม่เพียง แต่จะใช้เครื่องหมายอะพอสทรอฟีเหมือนในภาษาอังกฤษเท่านั้น แต่ถึงแม้ในสถานการณ์ที่พวกเขาจะไม่ใช้เป็นภาษาอังกฤษเช่นพหูพจน์เชิงมุม ( die Callgirl’s )

B. เช่นเดียวกับภาษาอังกฤษภาษาเยอรมันยังใช้เครื่องหมายอะพอสทรอฟีเพื่อระบุตัวอักษรที่ขาดหายไปในรูปแบบย่อสแลงภาษาถิ่นสำนวนหรือวลีบทกวี:  der Ku’damm (Kurfürstendamm), ich hab ‘(habe) ใน wen’gen Minuten (เวนิเกน) , wie geht’s? (geht es), Bitte, nehmen S ‘(Sie) Platz!  แต่ภาษาเยอรมันไม่ใช้เครื่องหมายวรรคตอนในการหดตัวทั่วไปที่มีบทความที่ชัดเจน:  ins (in das), zum (zu dem)

3. Komma  ( ลูกน้ำ )

A. ภาษาเยอรมันมักใช้ลูกน้ำในลักษณะเดียวกับภาษาอังกฤษ อย่างไรก็ตามภาษาเยอรมันอาจใช้เครื่องหมายจุลภาคเพื่อเชื่อมโยงสองอนุประโยคอิสระโดยไม่ต้องใช้ร่วมกัน (และ แต่หรือ) โดยที่ภาษาอังกฤษจะต้องมีเครื่องหมายอัฒภาคหรือเครื่องหมายจุด:  ใน dem alten Haus war es ganz ยังคงยืน angstvoll vor der Tür แต่ในภาษาเยอรมันคุณยังมีตัวเลือกในการใช้อัฒภาคหรือจุดในสถานการณ์เหล่านี้

B. แม้ว่าจุลภาคจะเป็นตัวเลือกในภาษาอังกฤษในตอนท้ายของซีรีส์ที่ลงท้ายด้วยและ / หรือ แต่จะไม่ใช้ในภาษาเยอรมัน:  Hans, Julia und Frank kommen mit

C. ภายใต้กฎการสะกดแบบใหม่ (Rechtschreibreform) ภาษาเยอรมันใช้จุลภาคน้อยกว่ากฎเดิมมาก ในหลายกรณีที่ก่อนหน้านี้ต้องใช้เครื่องหมายจุลภาคตอนนี้เป็นทางเลือก ตัวอย่างเช่นวลี infinitive ที่ก่อนหน้านี้กำหนดโดยลูกน้ำเสมอสามารถไปได้โดยไม่ต้องใช้:  Er ging (,) ohne ein Wort zu sagen  ในกรณีอื่น ๆ อีกมากมายที่ภาษาอังกฤษจะใช้ลูกน้ำ แต่ภาษาเยอรมันจะไม่ใช้

D. ในนิพจน์ตัวเลขภาษาเยอรมันใช้ลูกน้ำโดยที่ภาษาอังกฤษใช้จุดทศนิยม:  19,95 ยูโร (19.95 ยูโร)  ในจำนวนมากภาษาเยอรมันจะใช้ช่องว่างหรือจุดทศนิยมเพื่อหารพัน:  8 540,000 หรือ 8.540.000 = 8,540,000  (สำหรับข้อมูลเพิ่มเติมเกี่ยวกับราคาโปรดดูรายการ 4C ด้านล่าง)

4. Gedankenstrich  (Dash, Long Dash)

A. ภาษาเยอรมันใช้เส้นประหรือเส้นประยาวในลักษณะเดียวกับภาษาอังกฤษเพื่อระบุการหยุดชั่วคราวความต่อเนื่องที่ล่าช้าหรือเพื่อระบุความแตกต่าง:  Plötzlich – eine unheimliche Stille

ข. เยอรมันใช้เส้นประเพื่อระบุการเปลี่ยนแปลงในลำโพงเมื่อไม่มีเครื่องหมายคำพูด: Karl, komm bitte doch her! – Ja, ich komme sofort

C. ภาษาเยอรมันใช้เส้นประหรือเส้นประยาวในราคาที่ภาษาอังกฤษใช้เลขศูนย์สองเท่า: € 5, – (5.00 ยูโร)