HP-UX Event ManagerAdministrator's Guide

Using Event Manager
Monitoring Events
Chapter 248
In the previous example, the input to the evmpost command for the
success event is simple, so it is supplied on the same line by using the
echo command. For the failure event, the value of the result_code
variable must also be supplied. To supply this value, the shell's << syntax
provides a more structured multiline form of input. Both forms of input
supply source code input to the evmget command through its standard
input (stdin) stream.
For more information about posting events from the command line, or
from within a shell script, see evmpost (1).
Understanding the Event Manager Mark Event
When you review or monitor event activity, you observe the following
event that occurs every 15 minutes:
26-Jun-2000 08:57:45 [200] EVM: Mark event
The evmlog event channel posts this event to ensure that there is
periodic event activity. If your system has a problem and you need to
determine when it was last operational, you can look for mark commands
in the evm log by using the following command:
# evmget -f "[name *.evm.mark]" | evmshow -t "@timestamp
@last_timestamp @@"
26-Jun-2000 00:57:35 26-Jun-2000 04:42:40 [16 times] EVM:
Mark event
26-Jun-2000 04:57:41 - EVM: Mark event
26-Jun-2000 05:12:41 - EVM: Mark event
26-Jun-2000 05:27:41 - EVM: Mark event
26-Jun-2000 05:42:41 26-Jun-2000 09:12:45 [15 times] EVM:
Mark event
If the default logger configuration file is in use, you usually see three
individual mark events, followed by a single event preceded by [n times],
where n is a number less than or equal to 16. This is the result of the
logger's suppression facility, which minimizes wasted space by combining
multiple events over a period of up to four hours. The normal timestamp
value shows the first occurrence of a combined event, and the
last_timestamp data item shows the time of the last occurrence. The
example includes the last_timestamp data item in the show-template,
which displays the last mark event, posted at 09:12:45. This mark event
tells you that the system was operational at that time.