Skip to main content
Version: User Guide 6.5

Report Example: Simple Counters

This syslog report template provides an example of how to count syslog messages containing specific keywords.

REPORT GOAL

We need to count the messages containing Keyword1, Keyword2, etc. separately.

The initial step is to create a new template, specifying its name and optional description.

Pre SQL Commands

The initialization (Pre) commands create a table for the counters and set them all to zero:

CREATE TABLE Counters (Name TEXT PRIMARY KEY, Value INTEGER);

INSERT INTO Counters (Name, Value) VALUES
('Keyword1', 0),
('Keyword2', 0);

Commands

For each keyword, add a counter increment command:

UPDATE Counters SET Value = Value + 1 WHERE Name = 'Keyword1';

This command will be executed for all messages that match the filter:

{MESSAGE} CONTAINS "Keyword1"

Post SQL Commands

All calculations are performed during report generation, so finalizing (Post) commands are not required.

Output Filename

The report's creation timestamp will create a unique file name:

Counters-{GENERATED_S|%Y-%m-%dT%H-%M-%S}.html

Output Directory

Leaving the target directory empty will prompt you to enter the output directory each time the report is generated.

Output HTML

Here is a simple HTML that displays the counters:

<!DOCTYPE html>
<html lang="en">
<body>
<ul>
<li>Keyword1: {{EXECUTE SELECT Value FROM Counters WHERE Name='Keyword1';}}{0}{{END}}</li>
<li>Keyword2: {{EXECUTE SELECT Value FROM Counters WHERE Name='Keyword2';}}{0}{{END}}</li>
</ul>
</body>
</html>

You can enhance the template by including titles and the time period:

<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<title>Syslog report: Counters</title>
</head>
<body>
<h1>Syslog report: Counters</h1>
<p>{FROM_S|%F %T} - {TO_S|%F %T}</p>
<ul>
<li>Keyword1: {{EXECUTE SELECT Value FROM Counters WHERE Name='Keyword1';}}{0}{{END}}</li>
<li>Keyword2: {{EXECUTE SELECT Value FROM Counters WHERE Name='Keyword2';}}{0}{{END}}</li>
</ul>
</body>
</html>

Results

You will end up with something like this: Template editor shows the result report template configuration

You can download this report example (simple-counters.report.json) and import it into Syslog Watcher Manager.