HP-UX Event ManagerAdministrator's Guide

Using Event Manager
Introduction to Event Filters
Chapter 258
15-Apr-1999 14:19:06 0 EVM daemon: Configuration completed
15-Apr-1999 14:19:06 1 EVM daemon: Initialization completed
15-Apr-1999 14:19:06 2 EVM logger: Logger started
15-Apr-1999 14:19:06 3 EVM: Mark event - initial
15-Apr-1999 14:19:06 5 EVM logger: Started eventlog
/var/evm/evmlog/evmlog.19990415
[1] [2]
Where:
1. The age filter keyword selects all events that have occurred today, as
indicated by the timestamp in the first column of data.
2. The @event_id specifier in the show template instructs the evmshow
command to display the event-id for each retrieved event, which is
shown in the second column of data.
When the event-ids are displayed, you can select the events. For
example, use the following command to display details of the initial mark
event, which has an event-id of 3 in the preceding example output:
# evmget -f '[age < 1d] and [event_id = 3]' | evmshow -d | more
You can select a range of events by using a more complex filter, as shown
in the following example:
# evmget -f '[age < 1d] and [event_id >= 1] and [event_id <=
3]'| evmshow -d | more
Choose the time range carefully to select the right set of events. If you
recently rebooted your system, specify a filter of [age < 2h] to select
events occurring within the preceding two hours.
Searching for Reserved Component Names
Some event names include reserved component names as name
extensions. These components begin with an underscore character (_),
and usually are followed by a component that identifies the item for
which the event is being posted. For example, the names of many
hardware-related events include the component _hwid, followed by the
numeric hardware identifier of the item. Reserved component names are
appended automatically as an extension to the event name. The name is
appended, followed by the value for the named variable. This is done for
every reserved component name. For example, an event with the name
@SYS_VP@.temperature_high and the variable _degrees with the value
212 is observed as an event with the name
@SYS_VP@.temperature_high._degrees.212.