HP-UX Event ManagerAdministrator's Guide

Using Event Manager
Monitoring Events
Chapter 238
You can display events that are stored in the various system log files, or
monitor them as they occur by using the evmget and evmwatch
commands. For more information about these commands, see “Retrieving
Stored Events Using evmget” on page 38 and “Monitoring Events” on
page 35.
Most systems produce a large number of events, many of which report
normal operation. Use event filters to limit the display to a set of events
that you consider to be important. The section Introduction to Event
Filters introduces the filtering facilities.
Regardless where the events come from, you can use the evmshow
command to format them for display. For more information about
show-template, see evmshow (1).
Retrieving Stored Events Using evmget
You can use the evmget command to obtain the following:
• An ordered view by retrieving events from each of the various log
files.
• Convert the events to Event Manager events if they are not already
in that form.
• Return a single stream of Event Manager events.
Using the evmshow command, you can convert the Event Manager event
stream into a display format.
The following command pipeline uses the evmget command to retrieve
all system events, and passes them to the evmshow command for display:
# evmget | evmshow -t "@timestamp [@priority] @@" | more
The evmget command makes a service connection to the Event Manager
daemon, which starts a new copy of the get-server program,
/usr/sbin/evm_getsrv. The get-server program reads the channel
configuration file, and runs the get function, usually a shell script, for
each channel configured in the channel configuration file,
/etc/evmchannel.conf. This configuration file is described in
““Configuring Event Manager Channel” on page 65”.
The get function performs the following functions:
• Reads the channel log file
• Converts the events into EVM format