evmlogger.conf man page on HP-UX

Man page or keyword search:  
man Server   10987 pages
apropos Keyword Search (all sections)
Output format
HP-UX logo
[printable version]

evmlogger.conf(4)					     evmlogger.conf(4)

       evmlogger.conf - EVM logger configuration file

       The  file  is  the Event Manager (EVM) logger configuration file.  This
       file is read when the logger program, starts, and when reloads the con‐
       figuration file.

       When  reloads the configuration file, it reconfigures itself by reading
       its configuration file, again and updates its settings.

       The EVM daemon starts the Event Manager (EVM) logger  automatically  at
       startup.	  The EVM logger reads its configuration file to find a set of
       definitions of event logs and forwarders.  By default, the  EVM	logger
       reads  its  configuration  from the file.  The command can override the
       default configuration file by specifying a different file.  See evmlog‐
       ger(1M).	  If the logger's configuration file is changed while the log‐
       ger is running, use the command to instruct the logger  to  reconfigure

       The logger also reconfigures itself upon receipt of a SIGHUP signal.

       The  file  is  a	 text  file that contains values used to configure the
       event logger.  The values direct the display, forwarding, or storage of
       events.	 Any portion of a line from an unquoted number sign to the end
       of line is a comment.  Blank lines are ignored.

       Any number of event logs and forwarders can be defined in a  configura‐
       tion file.  The following keywords are recognized:

       Introduces a group of keyword/value pairs, which define an event log.
		 Events	 that match the log's log_filter_spec are selected for
		 handling by this log.

		 The name of the event log.

		 The type of the log.
			   Specify either or If the log_path specifies a  ter‐
			   minal device, such as the type is automatically set
			   to and cannot be forced to If the  log_path	speci‐
			   fies a file, the default type is Events are written
			   to formatted logs as single lines of text,  and  to
			   binary logs as raw EVM events.

		 The  template	used  to  format lines of text for a formatted
			   If no template is specified,	 the  event  timestamp
			   and	message	 are written.  See the evmshow(1) man‐
			   page for the template syntax.

		 Path name of the log file.
			   If a log is a disk file,  the  logger  creates  the
			   file if necessary.

			   If  the  log name ends in the characters the logger
			   replaces that suffix with the current date  in  the
			   form	 yyyymmdd.   A	new  file  is started when the
			   first event is written to the log each day.

		 Specifies an alternate path to be used	 in  cases  where  the
		 primary log
			   cannot be used.

			   If  the log file specified by becomes unusable, the
			   logger switches to the alternate log file.

			   If the logger is writing to the alternate log,  and
			   the	error  condition  which	 caused	 the logger to
			   switch has been cleared, you can revert to the pri‐
			   mary log file by using the command.

		 The maximum size, in kilobytes, that the log file may reach.
			   If  adding  an  event  to the file would cause this
			   size to be exceeded, the logger begins a new	 file.
			   The	logger	adds the suffix to the name of the new
			   file.  The n is a sequentially generated number.

		 Specifies the event selection filter.
			   Events passing this filter are selected for logging
			   to this event log; all others are ignored.  See the
			   EvmFilter(5) manpage for a  description  of	filter

		 Modifies the current
			   log_filter_spec.   See  the description of and key‐
			   words in the subsection.

		 Modifies the current
			   log_filter_spec.  See the description of  and  key‐
			   words in the subsection.

		 If this keyword is not specified, or if it is specified and
			   bool_par  has  a  value of or (zero), the event log
			   handles events posted  through  the	local  daemon.
			   Because  EVM	 currently supports only local connec‐
			   tion, this argument should not be set to TRUE.

		 The suppression facility minimizes resource waste by limiting
		 the number
			   of  identical  events  appearing  in	 the  log.   A
			   description of the event suppression group follows.

			   Before being written	 to  the  log,	each  incoming
			   event  is  matched  against the suppression group's
			   supp_filter_spec.  An event that passes the	filter
			   is  then  compared with other events that have been
			   posted during the last minutes, ignoring the	 time‐
			   stamp,  last_timestamp,  PID,  PPID,	 event-id  and
			   repeat-count data items.  If a  matching  event  is
			   found,  and	at  least  instances of the event have
			   been written to the log during the the logger  does
			   not	log the event.	Instead, the logger inserts or
			   updates the	and  data  items  in  the  last-logged
			   instance  of	 the  event.  The suppression is indi‐
			   cated by the string appearing in the	 message  text
			   when the event is displayed, where n is the

			   When	 an individual event becomes eligible for sup‐
			   pression, the suppression is canceled automatically
			   after  four	hours or after supp_period, which ever
			   is the greater  amount  of  time.   The  individual
			   event is reinstated when the suppression conditions
			   occur again.	 Suppression is canceled automatically
			   when a change of logfile occurs.

			   Suppression	directives  are	 ignored for formatted

			   The following keywords are recognized in a suppres‐
			   sion group:

			   Events  selected  by	 this  filter are eligible for
				     consideration.  See EvmFilter(5) for  the
				     filter syntax.

			   Modifies the current
				     supp_filter_spec.	See the description of
				     the and keywords in the subsection.

			   Modifies the current
				     supp_filter_spec.	See the description of
				     the and keywords in the subsection.

			   The	period,	 in  minutes,  over  which  events are
			   counted for suppression consideration.

			   The number of instances of an event that is	logged
				     supp_period before suppression begins.

       Events meeting the filter specifications are to be forwarded using the
		 command specified.

		 A name used to identify the forwarding definition.

		 Event forwarding filter specification.
			   Events  passing  this  filter are selected for for‐
			   warding as specified by the command .  See the Evm‐
			   Filter(5) manpage for the filter syntax.

		 Modifies the current
			   forward_filter_spec.	  See  the  description of the
			   and keywords in the subsection.

		 Modifies the current
			   forward_filter_spec.	 See the  description  of  the
			   and keywords in the subsection.

		 When  an incoming event is selected for handling by this for‐
		 warder, and
			   the event is not eligible for suppression, the log‐
			   ger	executes  this	command, piping the event into
			   the command's stream.

		 This keyword limits the number of events that can  be	queued
		 by a
			   forwarder  while  a previous event is being handled
			   by If the  maximum  number  of  events  is  already
			   queued  when	 a  new	 event	arrives,  the event is
			   ignored by this forwarder.  If not specified,  this
			   keyword  has	 a  default  value of 100.  If a value
			   greater than 1000 is specified, the logger automat‐
			   ically limits it to 1000.

			   See evmlogger(1M) for details of event queuing.

		 If this keyword is not specified, or if it is specified and
			   bool_par  has  a  value of or (zero), the forwarder
			   handles events posted  through  the	local  daemon.
			   Because  EVM	 currently supports only local connec‐
			   tion, this argument should not be set to TRUE.

		 Event suppression as applied  to  forwarding  is  similar  to
		 event log
			   suppression.	 The difference is that event suppres‐
			   sion for forwarding limits the number of  identical
			   events  that	 are  forwarded	 over  the suppression
			   period.  In this case, events  which	 are  eligible
			   for	suppression  are  simply  ignored  by the for‐
			   warder.  This feature reduces the chance of a large
			   volume  of  mail being sent during a period of high
			   event activity.

       This keyword specifies the path of a directory tree that holds zero or
		 more secondary configuration files.  The  directory  tree  is
		 searched when the logger is started and each time its config‐
		 uration is reloaded.

		 Configuration file names must end with	 and  must  not	 begin
		 with  a  dot Files must be owned by or and their file permis‐
		 sions must restrict writing  to  owner	 or  group.   Symbolic
		 links	and  subdirectory hierarchies can be used to reference
		 configuration files that physically are located elsewhere.

		 After installing, removing or modifying a secondary  configu‐
		 ration file, you must run the command to notify the logger of
		 the change and to request a configuration reload.

		 Any number of entries may be specified in the primary config‐
		 uration  file, but is not a valid keyword in a secondary con‐
		 figuration file.

   The include and exclude Keywords
       The and keywords can appear multiple  times  in	an  or	specification,
       allowing	 you  to  build	 and  maintain	a filter in simple single-line
       increments.  Each filter_element must be a valid	 filter	 string,  con‐
       forming	to  the	 syntax	 described in the EvmFilter(5) reference page.
       The logger assembles a complete filter string by surrounding  the  ini‐
       tial  filter  with parentheses and appending the filter_elements to it,
       separating each with a logical (for or (for operator.  For example:

       The previous filter lines are equivalent to this	 more  complex	single
       filter line:

       The  first  line	 selects all events with a priority of 200 or greater,
       the next modifies this by selecting all events from regardless of their
       priorities,  and	 the last line excludes all events regardless of their

       If you prefer, you can omit the command, and build the complete	filter
       string from and lines.

       If no filter, include or exclude lines are supplied for an event log or
       forwarder, it does not handle any events.

       Keywords may be entered in a case-insensitive  manner.	The  allowable
       strings	and the minimum number of characters is shown in the following
       table.  A minimum of zero indicates that all characters are required.

       Keyword		 Minimum
       alternate	    3
       command		    4
       configdir	    7
       eventlog		    0
       exclude		    3
       explicit_target	    4
       filter		    4
       forward		    4
       include		    3
       logfile		    3
       maxqueue		    4
       maxsize		    3

       name		    0
       period		    0
       show_template	    4
       suppress		    4
       threshold	    0
       type		    0

	 1. The logger only allows a single instance of each  forwarding  com‐
	    mand  to  execute  at  one	time and queues any events that arrive
	    while an instance  is  already  running.   The  forwarder  ignores
	    events  that  arrive  while	 the  queue  is full.  To minimize the
	    chances of queuing or missing events, avoid using  the  forwarding
	    facility  to  run  commands that may take significant time to exe‐

	 2. If you specify a forwarding command that may itself	 cause	events
	    to	be  posted (for instance, mail commands may post syslog events
	    that are routed to EVM), the forwarding filter  explicitly	should
	    exclude  those events.  Otherwise, it is possible that an infinite
	    event loop will occur.

	 3. To allow your file to be used on or ported to other	 systems  that
	    support  EVM  in the future, use the built-in macro instead of the
	    first two components of the name of any system event.

	    Using the built-in macro makes it unnecessary to change  the  file
	    if the other system uses a different event name prefix.

       This example initiates the command with the following configuration:

       Binary events are written to a file in the directory named where xxx is
       the current year, month, and day.  For example,

       An alternate log path is specified in case of  write  failures  to  the
       primary log path.

       A  new  generation  of  the  log	 is  started automatically if the size
       exceeds 256 KB.

       All events with a priority of at least 200 are selected for logging.

       Duplicate events are suppressed.

       Events with a priority of at least 600 are displayed on the system con‐
       sole  as	 formatted events, showing the timestamp, the priority and the
       event's message.

       Events with a priority of at least 600 are also mailed to root.

       A maximum of 20 events  is  queued  for	forwarding  to	root  when  an
       instance of the forwarding command is already running.

       Location of the EVM logger configuration file.

       Default location of the secondary EVM logger configuration files.

       evmget(1), evmshow(1), evmd(1M), evmlogger(1M), evmreload(1M).

   Event Management

   EVM Events

   Event Filter


List of man pages available for HP-UX

Copyright (c) for man pages and the logo by the respective OS vendor.

For those who want to learn more, the polarhome community provides shell access and support.

[legal] [privacy] [GNU] [policy] [cookies] [netiquette] [sponsors] [FAQ]
Polarhome, production since 1999.
Member of Polarhome portal.
Based on Fawad Halim's script.
Vote for polarhome
Free Shell Accounts :: the biggest list on the net