evm.5 (2010 09)

e
EVM(5) EVM(5)
supplied commands on receipt of selected events.
For more information refer to the evmlogger (1M) and evmlogger.conf(4) manpages.
The EVM Channel Manager
The EVM channel manager,
evmchmgr, is started automatically by the daemon, and is responsible for
managing time-based event channel functions. The channel manager reads the EVM channel
configuration file and periodically runs event monitoring commands for any configured passive channels.
The program also is responsible for running daily logfile cleanup commands.
The channel manager and the channel configuration file are described in the evmchmgr(1M) and
evmchannel.conf(4) manpages.
Command Line Utilities
EVM’s system administration facilities include a set of command line utilities that can be used from the
command line or in shell scripts to post events, to monitor event activity, to retrieve stored events from
log files, and to sort and view events in a variety of ways. The utilities are designed to be used together in
shell pipelines. For more information refer to the evmpost(1) , evmwatch(1) , evmget(1) , evmsort(1) , and
evmshow(1) manpages.
Filtering Events
Because a system may generate many events over the course of a day, it is often desirable to limit your
view to the particular set in which you are interested. For example, you may want to see the events
posted by one particular subsystem, or all events with a high priority value. EVM events can be selected
by using an event filter which is a character string that describes the selection using a predefined filter
syntax. You can use a filter to select events according to several different criteria, including event name,
timestamp, priority and the name of the posting system.
You can use an event filter by specifying the
-f option to several of the EVM command line utilities. The
EVM logger uses event filters in its configuration file to select the actions to be taken when specific events
occur. Frequently-used event filters can be stored in filter files for easy reference.
For details of the event filter syntax and the use of filter files, refer to the EvmFilter (5) and
evmfilterfile(4) manpages.
Event Template Files
Event template files are used to control the set of events that can be posted on a given system, and to pro-
vide a central source for much of the information that is carried in a given event. For example, the prior-
ity and message text for a given event are likely to be the same each time the event is posted, and central-
izing this information makes it much easier to see and maintain than if the information was held in the
posting program or the kernel.
An event template file is a text file that holds template information for one or more named events. A tem-
plate file must be installed before the events it describes can be posted, and is read by the EVM daemon
each time the daemon starts or reloads its configuration. When an event is posted, the daemon adds the
information held in the template to the posted event before distributing it to subscribers.
For more information about the purpose and the syntax of template files see the evmtemplate (4) man-
page.
Event Authorization
Because the unrestricted ability to monitor or post certain events could compromise security in some
environments, EVM provides a means of restricting the ability to post and access selected events to
specific authorized users. Refer to the evm.auth (4) manpage for more information.
The EVM Programming Interface
The EVM application programming interface (API) library,
libevm.so, provides all the functions
required for an application program to create, post and subscribe for events, to read and write them from
and to standard file descriptors, and to manipulate their contents. For a full discussion of programming
with EVM, refer to the EVM Programmer’s Guide and the manpages for the routines listed in the SEE
ALSO section.
EVM supports event posting and subscription in kernel space through the pseudo-device driver
/dev/kevm.
2 Hewlett-Packard Company − 2 − HP-UX 11i Version 3: September 2010