evm.5 (2010 09)

e
EVM(5) EVM(5)
NAME
EVM - event management
DESCRIPTION
Introduction to Events and Event Management
The purpose of an event management system is to provide a means for any system component or applica-
tion to indicate that something has happened that may be of interest to some other entity. The indication
is known as an event, and the component posting the event is known as an event generator or event
poster. The entity interested in the indication is known as an event subscriber.
When a system component has something interesting to report, it makes the information available
through an event channel. The term event channel describes any facility used to publish or retrieve event
information, and might refer to any of the following:
• A simple log file
• An event management system
• A program that can be run to obtain a snapshot of status information
An event management system is an active event channel, and as such it provides services for distributing,
storing and retrieving event information.
The HP-UX system logger, syslog, is an example of an event management system. It provides a simple
event distribution facility for other components to use, and its daemon actively manages the event infor-
mation it receives. By contrast, the
cron daemon’s log file,
/var/adm/cron/log, is an example of a
passive event channel. The
cron daemon simply writes new event information to the end of its file, and
takes no special action to notify interested entities when it does so.
In general, an event poster is unaware of any entities that might be interested in its event information. It
simply uses an available event channel to post the event. It is the responsibility of the event channel to
decide how to make the event available, and to whom. The event subscriber is responsible for identifying
an interest in events to the event channel. A subscriber might be a user-level process, a kernel subsys-
tem, or (through some utility program) a user.
About EVM
The Event Manager (EVM) is a comprehensive event management system that, in addition to providing
traditional event handling facilities, unifies events from many channels to provide a system-wide source
of information. For information about using EVM as an aid to system administration, see the EVM Sys-
tem Administration Guide.
The EVM Event
An EVM event is a package of information that can be passed between programs and stored in files. The
underlying format of an event package is binary, but supplied commands and programming interfaces
can be used to extract and display the information contained in an event. The term raw event is used to
refer to an event in its binary state, while an event that has been converted to text form for display is said
to be formatted.
An EVM event may contain any or all of a set of standard event data items, including (but not limited to)
an event name, a timestamp, a priority value and some message text. An event may also carry any
number of named variable data items, each of which can hold further information about the event. EVM
events can carry events from other channels, such as the binary error logger, by holding them in variable
data items.
Full details of the EVM event are provided in the EvmEvent (5) manpage.
The EVM Daemon
The EVM daemon,
evmd, is started automatically when the system is initialized to level 2. The daemon
provides posting and notification services for system and application clients running on the local system.
Refer to the evmd(1M) and evmdaemon.conf(4) manpages for more information.
The EVM Logger
The EVM logger,
evmlogger, is an event subscriber that is started automatically by the daemon. The
logger reads its configuration file to establish the set of events to be logged, subscribes for those events,
and stores them in managed logfiles as they arrive. By default, the logger also displays high priority
events on the system console, and mails information about them to the root user. The logger can be
configured to manage any number of logfiles, each with its own selection of events, and to execute user-
HP-UX 11i Version 3: September 2010 − 1 − Hewlett-Packard Company 1