evmlogger.conf(4) hpux man page

evmlogger.conf(4) Kernel Interfaces Manual evmlogger.conf(4)

NAME
evmlogger.conf - EVM logger configuration file

SYNOPSIS
DESCRIPTION
The file is the Event Manager (EVM) logger configuration file. This file is read when the logger program, starts, and when reloads the
configuration file.

When reloads the configuration file, it reconfigures itself by reading its configuration file, again and updates its settings.

The EVM daemon starts the Event Manager (EVM) logger automatically at startup. The EVM logger reads its configuration file to find a set
of definitions of event logs and forwarders. By default, the EVM logger reads its configuration from the file. The command can override
the default configuration file by specifying a different file. See evmlogger(1M). If the logger's configuration file is changed while the
logger is running, use the command to instruct the logger to reconfigure itself.

The logger also reconfigures itself upon receipt of a SIGHUP signal.

The file is a text file that contains values used to configure the event logger. The values direct the display, forwarding, or storage of
events. Any portion of a line from an unquoted number sign to the end of line is a comment. Blank lines are ignored.

Any number of event logs and forwarders can be defined in a configuration file. The following keywords are recognized:

Introduces a group of keyword/value pairs, which define an event log.
Events that match the log's log_filter_spec are selected for handling by this log.

The name of the event log.

The type of the log.
Specify either or If the log_path specifies a terminal device, such as the type is automatically set to and cannot be
forced to If the log_path specifies a file, the default type is Events are written to formatted logs as single lines of
text, and to binary logs as raw EVM events.

The template used to format lines of text for a formatted log.
If no template is specified, the event timestamp and message are written. See the evmshow(1) manpage for the template
syntax.

Path name of the log file.
If a log is a disk file, the logger creates the file if necessary.

If the log name ends in the characters the logger replaces that suffix with the current date in the form yyyymmdd. A
new file is started when the first event is written to the log each day.

Specifies an alternate path to be used in cases where the primary log
cannot be used.

If the log file specified by becomes unusable, the logger switches to the alternate log file.

If the logger is writing to the alternate log, and the error condition which caused the logger to switch has been
cleared, you can revert to the primary log file by using the command.

The maximum size, in kilobytes, that the log file may reach.
If adding an event to the file would cause this size to be exceeded, the logger begins a new file. The logger adds the
suffix to the name of the new file. The n is a sequentially generated number.

Specifies the event selection filter.
Events passing this filter are selected for logging to this event log; all others are ignored. See the EvmFilter(5)
manpage for a description of filter syntax.

Modifies the current
log_filter_spec. See the description of and keywords in the subsection.

If this keyword is not specified, or if it is specified and
bool_par has a value of or (zero), the event log handles events posted through the local daemon. Because EVM currently
supports only local connection, this argument should not be set to TRUE.

The suppression facility minimizes resource waste by limiting the number
of identical events appearing in the log. A description of the event suppression group follows.

Before being written to the log, each incoming event is matched against the suppression group's supp_filter_spec. An
event that passes the filter is then compared with other events that have been posted during the last minutes, ignoring
the timestamp, last_timestamp, PID, PPID, event-id and repeat-count data items. If a matching event is found, and at
least instances of the event have been written to the log during the the logger does not log the event. Instead, the
logger inserts or updates the and data items in the last-logged instance of the event. The suppression is indicated by
the string appearing in the message text when the event is displayed, where n is the

When an individual event becomes eligible for suppression, the suppression is canceled automatically after four hours
or after supp_period, which ever is the greater amount of time. The individual event is reinstated when the suppres-
sion conditions occur again. Suppression is canceled automatically when a change of logfile occurs.

Suppression directives are ignored for formatted logs.

The following keywords are recognized in a suppression group:

Events selected by this filter are eligible for suppression
consideration. See EvmFilter(5) for the filter syntax.

Modifies the current
supp_filter_spec. See the description of the and keywords in the subsection.

The period, in minutes, over which events are counted for suppression consideration.

The number of instances of an event that is logged during
supp_period before suppression begins.

Events meeting the filter specifications are to be forwarded using the
command specified.

A name used to identify the forwarding definition.

Event forwarding filter specification.
Events passing this filter are selected for forwarding as specified by the command . See the EvmFilter(5) manpage for
the filter syntax.

Modifies the current
forward_filter_spec. See the description of the and keywords in the subsection.

When an incoming event is selected for handling by this forwarder, and
the event is not eligible for suppression, the logger executes this command, piping the event into the command's
stream.

This keyword limits the number of events that can be queued by a
forwarder while a previous event is being handled by If the maximum number of events is already queued when a new event
arrives, the event is ignored by this forwarder. If not specified, this keyword has a default value of 100. If a
value greater than 1000 is specified, the logger automatically limits it to 1000.

See evmlogger(1M) for details of event queuing.

If this keyword is not specified, or if it is specified and
bool_par has a value of or (zero), the forwarder handles events posted through the local daemon. Because EVM currently
supports only local connection, this argument should not be set to TRUE.

Event suppression as applied to forwarding is similar to event log
suppression. The difference is that event suppression for forwarding limits the number of identical events that are
forwarded over the suppression period. In this case, events which are eligible for suppression are simply ignored by
the forwarder. This feature reduces the chance of a large volume of mail being sent during a period of high event
activity.

This keyword specifies the path of a directory tree that holds zero or
more secondary configuration files. The directory tree is searched when the logger is started and each time its configuration is
reloaded.

Configuration file names must end with and must not begin with a dot Files must be owned by or and their file permissions must
restrict writing to owner or group. Symbolic links and subdirectory hierarchies can be used to reference configuration files
that physically are located elsewhere.

After installing, removing or modifying a secondary configuration file, you must run the command to notify the logger of the
change and to request a configuration reload.

Any number of entries may be specified in the primary configuration file, but is not a valid keyword in a secondary configuration
file.

The include and exclude Keywords
The and keywords can appear multiple times in an or specification, allowing you to build and maintain a filter in simple single-line incre-
ments. Each filter_element must be a valid filter string, conforming to the syntax described in the EvmFilter(5) reference page. The log-
ger assembles a complete filter string by surrounding the initial filter with parentheses and appending the filter_elements to it, separat-
ing each with a logical (for or (for operator. For example:

The previous filter lines are equivalent to this more complex single filter line:

The first line selects all events with a priority of 200 or greater, the next modifies this by selecting all events from regardless of
their priorities, and the last line excludes all events regardless of their priorities.

If you prefer, you can omit the command, and build the complete filter string from and lines.

If no filter, include or exclude lines are supplied for an event log or forwarder, it does not handle any events.

Keywords
Keywords may be entered in a case-insensitive manner. The allowable strings and the minimum number of characters is shown in the following
table. A minimum of zero indicates that all characters are required.

Keyword Minimum
--------------------------
alternate 3
command 4
configdir 7
eventlog 0
exclude 3
explicit_target 4
filter 4
forward 4
include 3
logfile 3
maxqueue 4
maxsize 3
name 0
period 0
show_template 4
suppress 4
threshold 0
type 0

Notes
1. The logger only allows a single instance of each forwarding command to execute at one time and queues any events that arrive while an
instance is already running. The forwarder ignores events that arrive while the queue is full. To minimize the chances of queuing or
missing events, avoid using the forwarding facility to run commands that may take significant time to execute.

2. If you specify a forwarding command that may itself cause events to be posted (for instance, mail commands may post syslog events that
are routed to EVM), the forwarding filter explicitly should exclude those events. Otherwise, it is possible that an infinite event
loop will occur.

3. To allow your file to be used on or ported to other systems that support EVM in the future, use the built-in macro instead of the
first two components of the name of any system event.

Using the built-in macro makes it unnecessary to change the file if the other system uses a different event name prefix.

EXAMPLES
This example initiates the command with the following configuration:

Binary events are written to a file in the directory named where xxx is the current year, month, and day. For example,

An alternate log path is specified in case of write failures to the primary log path.

A new generation of the log is started automatically if the size exceeds 256 KB.

All events with a priority of at least 200 are selected for logging.

Duplicate events are suppressed.

Events with a priority of at least 600 are displayed on the system console as formatted events, showing the timestamp, the priority and the
event's message.

Events with a priority of at least 600 are also mailed to root.

A maximum of 20 events is queued for forwarding to root when an instance of the forwarding command is already running.

FILES
Location of the EVM logger configuration file.

Default location of the secondary EVM logger configuration files.

SEE ALSO
Commands
evmget(1), evmshow(1), evmd(1M), evmlogger(1M), evmreload(1M).

Event Management
EVM(5).

EVM Events
EvmEvent(5).

Event Filter
EvmFilter(5).

evmlogger.conf(4)

evmlogger.conf(4) hpux man page | unix.com