HP-UX Event ManagerAdministrator's Guide

Using Event Manager
Introduction to Event Filters
Chapter 256
Advanced Selection and Filtering Techniques
This section describes some additional filtering techniques that you can
use to further improve event selection, so that you receive only the
events in which you are interested. Following are the filtering
techniques:
• How to filter events according to their time of posting (Filtering By
Time)
• How to filter using the event-id identifier (Using the Event-Id to
Select Events for Detailed Display)
• How to filter using reserved component names (Searching for
Reserved Component Names)
• How to use filter files (Using Filter Files)
Filtering By Time
You can filter for events according to the time at which they were posted
by using the timestamp, before, since, and age keywords. You may find
that the age keyword is the easiest of these keywords to use, and the
most useful for everyday operation.
When you use the timestamp keyword, you must supply a string that
defines a time range in the following way:
year:month-of-year:day-of-month:day-of-week:hours:minutes:seco
nds
You can use an asterisk (*) as a wildcard character for any of the
components. To select events that occurred on July 6, 2002, you can use
the following commands:
# export EVM_SHOW_TEMPLATE="@timestamp [@priority] @@"
# evmget -A -f '[timestamp 2002:7:6:*:*:*:*]' | more
The asterisks (*) in the final four components indicate that you are
interested in all events that occurred on that day, no matter what time
they occurred. In addition, you can specify one or more ranges in any
position, as shown in the following command:
# evmget -A -f '[timestamp 2002:*:*:1-3,5:*:*:*]' | more
The fourth component specifies the day of the week. Searching for events
with posting times in the range one to three or five yields all events that
were posted on a Monday, Tuesday, Wednesday or Friday in the year
2002.