EVM(5)EVM(5)NAMEEVM - event management
Introduction to Events and Event Management
The purpose of an event management system is to provide a means for any
system component or application to indicate that something has happened
that may be of interest to some other entity. The indication is known
as an event, and the component posting the event is known as an event
generator or event poster. The entity interested in the indication is
known as an event subscriber.
When a system component has something interesting to report, it makes
the information available through an event channel. The term event
channel describes any facility used to publish or retrieve event infor‐
mation, and might refer to any of the following:
· A simple log file
· An event management system
· A program that can be run to obtain a snapshot of status informa‐
An event management system is an active event channel, and as such it
provides services for distributing, storing and retrieving event infor‐
The HP-UX system logger, syslog, is an example of an event management
system. It provides a simple event distribution facility for other
components to use, and its daemon actively manages the event informa‐
tion it receives. By contrast, the daemon's log file, is an example of
a passive event channel. The daemon simply writes new event informa‐
tion to the end of its file, and takes no special action to notify
interested entities when it does so.
In general, an event poster is unaware of any entities that might be
interested in its event information. It simply uses an available event
channel to post the event. It is the responsibility of the event chan‐
nel to decide how to make the event available, and to whom. The event
subscriber is responsible for identifying an interest in events to the
event channel. A subscriber might be a user-level process, a kernel
subsystem, or (through some utility program) a user.
The Event Manager (EVM) is a comprehensive event management system
that, in addition to providing traditional event handling facilities,
unifies events from many channels to provide a system-wide source of
information. For information about using EVM as an aid to system
administration, see the
The EVM Event
An EVM event is a package of information that can be passed between
programs and stored in files. The underlying format of an event pack‐
age is binary, but supplied commands and programming interfaces can be
used to extract and display the information contained in an event. The
term raw event is used to refer to an event in its binary state, while
an event that has been converted to text form for display is said to be
An EVM event may contain any or all of a set of standard event data
items, including (but not limited to) an event name, a timestamp, a
priority value and some message text. An event may also carry any num‐
ber of named variable data items, each of which can hold further infor‐
mation about the event. EVM events can carry events from other chan‐
nels, such as the binary error logger, by holding them in variable data
Full details of the EVM event are provided in the EvmEvent(5) manpage.
The EVM Daemon
The EVM daemon, is started automatically when the system is initialized
to level 2. The daemon provides posting and notification services for
system and application clients running on the local system. Refer to
the evmd(1M) and evmdaemon.conf(4) manpages for more information.
The EVM Logger
The EVM logger, is an event subscriber that is started automatically by
the daemon. The logger reads its configuration file to establish the
set of events to be logged, subscribes for those events, and stores
them in managed logfiles as they arrive. By default, the logger also
displays high priority events on the system console, and mails informa‐
tion about them to the root user. The logger can be configured to man‐
age any number of logfiles, each with its own selection of events, and
to execute user-supplied commands on receipt of selected events.
For more information refer to the evmlogger(1M) and evmlogger.conf(4)
The EVM Channel Manager
The EVM channel manager, is started automatically by the daemon, and is
responsible for managing time-based event channel functions. The chan‐
nel manager reads the EVM channel configuration file and periodically
runs event monitoring commands for any configured passive channels.
The program also is responsible for running daily logfile cleanup com‐
The channel manager and the channel configuration file are described in
the evmchmgr(1M) and evmchannel.conf(4) manpages.
Command Line Utilities
EVM's system administration facilities include a set of command line
utilities that can be used from the command line or in shell scripts to
post events, to monitor event activity, to retrieve stored events from
log files, and to sort and view events in a variety of ways. The util‐
ities are designed to be used together in shell pipelines. For more
information refer to the evmpost(1), evmwatch(1), evmget(1), evm‐
sort(1), and evmshow(1) manpages.
Because a system may generate many events over the course of a day, it
is often desirable to limit your view to the particular set in which
you are interested. For example, you may want to see the events posted
by one particular subsystem, or all events with a high priority value.
EVM events can be selected by using an event filter which is a charac‐
ter string that describes the selection using a predefined filter syn‐
tax. You can use a filter to select events according to several dif‐
ferent criteria, including event name, timestamp, priority and the name
of the posting system.
You can use an event filter by specifying the option to several of the
EVM command line utilities. The EVM logger uses event filters in its
configuration file to select the actions to be taken when specific
events occur. Frequently-used event filters can be stored in filter
files for easy reference.
For details of the event filter syntax and the use of filter files,
refer to the EvmFilter(5) and evmfilterfile(4) manpages.
Event Template Files
Event template files are used to control the set of events that can be
posted on a given system, and to provide a central source for much of
the information that is carried in a given event. For example, the
priority and message text for a given event are likely to be the same
each time the event is posted, and centralizing this information makes
it much easier to see and maintain than if the information was held in
the posting program or the kernel.
An event template file is a text file that holds template information
for one or more named events. A template file must be installed before
the events it describes can be posted, and is read by the EVM daemon
each time the daemon starts or reloads its configuration. When an
event is posted, the daemon adds the information held in the template
to the posted event before distributing it to subscribers.
For more information about the purpose and the syntax of template files
see the evmtemplate(4) manpage.
Because the unrestricted ability to monitor or post certain events
could compromise security in some environments, EVM provides a means of
restricting the ability to post and access selected events to specific
authorized users. Refer to the evm.auth(4) manpage for more informa‐
The EVM Programming Interface
The EVM application programming interface (API) library, provides all
the functions required for an application program to create, post and
subscribe for events, to read and write them from and to standard file
descriptors, and to manipulate their contents. For a full discussion
of programming with EVM, refer to the and the manpages for the routines
listed in the section.
EVM supports event posting and subscription in kernel space through the
evmget(1), evminfo(1), evmpost(1), evmshow(1), evmsort(1), evmwatch(1),
evmchmgr(1M), evmd(1M), evmlogger(1M), evmreload(1M), evmstart(1M),
EvmConnControl(3), EvmConnCreate(3), EvmConnSubscribe(3), EvmCon‐
nWait(3), EvmEventCreate(3), EvmEventDump(3), EvmEventFormat(3),
EvmEventPost(3), EvmEventRead(3), EvmEventValidate(3), EvmFilterCre‐
ate(3), EvmItemSet(3), EvmSrvStart(3), EvmStatusTextGet(3), Evm‐
evm.auth(4), evmchannel.conf(4), evmdaemon.conf(4), evmfilterfile(4),