Documentation: 3.2.3
|  Print Version Contents
This page last updated: 04/21/08 04:04pm

How transaction types work

A transaction type is a grouping of events that contain related pieces of information. Any number of data sources can generate transactions over multiple log entries. Transaction search is useful for a single observation of any physical event stretching over multiple logged events.

Here are some typical entries that could be grouped as a transaction:

  • An event in a Web access log
  • An event in an application server log
  • An event in an asynchronous fulfillment application that generates a message queue that subsequently identifies a business transaction

In this case, the Web access log might share a session ID with the event in the application server log; the application server log might contain the account ID, transaction ID, and product ID; the transaction ID may live in the message queue with a message ID, and the fulfillment application may log the message ID along with the shipping status. All of this data represents a single user transaction.

Define transactions

Define transactions in two ways:

  1. By editing transactiontypes.conf:
    • Define transactions by creating a stanza and listing specifications.
  2. In your search terms:
    • Use the transaction command to define a transaction or override transaction options specified in transactiontypes.conf.

Sample use cases

There are many cases where transactions are useful. Here are some use cases for transaction search:

  • Find quarantined mail messages where:
    • All events printed to a mail log for the different steps in processing a given message are considered to be a transaction.
    • All events in the transaction share a message ID or a process ID with events that have both a process ID and message ID providing the transition.
    • Queue entry events containing the sender's email address, and separate delivery events for each recipient of the message.
  • To find a security issue:
    • A sequence of 3 specific error messages in a particular order within a time frame on a given host that may be consistent with a known failure or attack pattern.
  • To combine any combination of specific event types:
    • Any transaction from a single data source that generates multiple log entries for a single event.
Previous: Dynamic event rendering    |    Next: Transaction types via configuration files

Comments

No comments have been submitted.

Log in to comment.