# TYPE mce_events counter                                                                                  mce_events{prog="kernel.mtail",instance="wezen"} 1108
# TYPE cpu_throttled counter
cpu_throttled{prog="kernel.mtail",instance="wezen"} 9554
# TYPE edac_events counter
# TYPE upstart_respawn counter
upstart_respawn{service="nova-spiceproxy",prog="kernel.mtail",instance="wezen"} 5302
upstart_respawn{service="nova-novncproxy",prog="kernel.mtail",instance="wezen"} 5078
upstart_respawn{service="ganglia-monitor",prog="kernel.mtail",instance="wezen"} 560
# TYPE oom_kill counter
oom_kill{binary="convert",prog="kernel.mtail",instance="wezen"} 91
oom_kill{binary="thumbor",prog="kernel.mtail",instance="wezen"} 12
oom_kill{binary="gs",prog="kernel.mtail",instance="wezen"} 2
oom_kill{binary="rsvg-convert",prog="kernel.mtail",instance="wezen"} 6
# TYPE segfault counter
segfault{binary="rsvg-convert",prog="kernel.mtail",instance="wezen"} 641
segfault{binary="check_sslxNN",prog="kernel.mtail",instance="wezen"} 1
segfault{binary="gs",prog="kernel.mtail",instance="wezen"} 6

# Syslog decorator
def syslog {/(?P<date>(?P<legacy_date>\w+\s+\d+\s+\d+:\d+:\d+)|(?P<rfc3339_date>\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}.\d+[+-]\d{2}:\d{2}))/ +
    /\s+(?:\w+@)?(?P<hostname>[\w\.-]+)\s+(?P<application>[\w\.-]+)(?:\[(?P<pid>\d+)\])?:\s+(?P<message>.*)/ {
        len($legacy_date) > 0 {
            strptime($2, "Jan _2 15:04:05")
        }
        len($rfc3339_date) > 0 {
            strptime($rfc3339_date, "2006-01-02T03:04:05-0700")
        }
        next
    }
}

@syslog {
counter mce_events
counter cpu_throttled
counter edac_events
counter upstart_respawn by service
counter oom_kill by binary
counter segfault by binary

/kernel: \[[\d.]+\] mce: .*Machine check events logged/ {
  mce_events++
}

/kernel: \[[\d.]+\] .* above threshold, cpu clock throttled/ {
  cpu_throttled++
}

/kernel: \[[\d.]+\] EDAC .*/ {
  edac_events++
}

/kernel: \[[\d.]+\] init: (?P<service>[\S]+) .*process ended, respawning/ {
  upstart_respawn[$service]++
}

/kernel: \[[\d.]+\] (?P<binary>[\S]+) invoked oom-killer:.*/ {
  oom_kill[$binary]++
}

/kernel: \[[\d.]+\] (?P<binary>[^\[]+)\[\d+\]: segfault at.*/ {
  segfault[$binary]++
}

}