evmfilter.5 (2010 09)

ManualsBrandsHP ManualsSoftwareHP-UX Manpages

EvmFilter(5) EvmFilter(5)

NAME

EvmFilter - EVM (Event Management) event ﬁlter

DESCRIPTION

An event ﬁlter is a speciﬁcation of a set of interesting events. Event subscribers use ﬁlters to tell the

EVM daemon which events they want to receive. For example, one subscriber may be only interested in

receiving events reporting hardware errors, while another may want to receive all high-priority events,

regardless of what they are reporting. If a subscriber does not set a ﬁlter, it will receive no events.

The Event Viewer and some of the EVM user commands also use ﬁlters to select events for viewing or

processing.

A ﬁlter is an ASCII character string. It can be very simple or arbitrarily complex. Complex ﬁlters are

created by combining simple ﬁlters.

A simple ﬁlter has the following format:

[keyword expr] | all | 1 | none | 0

The format of expr is speciﬁc to the type of ﬁlter. The left and right square brackets (

[ and ]) are

required. Keywords may be speciﬁed in any mix of upper and lower case, and where the underscore char-

acter (

_) is included in a full-length keyword (as in

host_name), it may be omitted. Keywords may be

abbreviated, and in the following paragraphs the minimum abbreviation for each is indicated by upper-

case letters.

Possible values for keyword and the associated expr are as follows:

Name event-name-specifier

Selects events with a name matching the event-name-speciﬁer. Names are considered to

match when the event name matches as many components as included in the ﬁlter.

The event-name-speciﬁer may include the

* and the ? characters as wildcards in any com-

ponent position. The

* represents 0 or more components with any value. The ? represents

exactly one component. Any event-name-speciﬁer includes an implied trailing

.* wildcard.

Priority equality-operator integer

Only events with a priority meeting the speciﬁed evaluation will be passed. The integer value

may be 0 to 700, inclusive. See the following table for a description of equality-operator. May

be speciﬁed as prio.

Timestamp time-range-specifier

All events with a timestamp that is within the time-range-speciﬁer are passed. See the

description of time-range-speciﬁer. May be speciﬁed as

time.

Age equality-operator age-specifier

Selects events that meet the age speciﬁcation. See the description of age-speciﬁer. The

equality-operator must specify

less-than or less-than-or-equal, meaning "newer

than", or

greater-than or greater-than-or-equal

, meaning "older than." The

equal or not equal operators are not allowed.

BEFore absolute-time-specifier

All events with a timestamp that is earlier than the absolute-time-speciﬁer are passed. See the

description of absolute-time-speciﬁer.

SINce absolute-time-specifier

All events with a timestamp that is equal to or later than the absolute-time-speciﬁer are

passed. See the description of absolute-time-speciﬁer.

EVent_id equality-operator integer

All events with an event_id meeting the speciﬁed evaluation will be passed. See EvmEvent (5)

for a description of the event_id . See the following table for a description of equality-operator.

The EVent_id keyword may be abbreviated to ID.

NONE or 0 A ﬁlter value of none or 0 (zero) passes no events.

ALL or 1 A ﬁlter value of all or 1 passes all events.

The available equality-operator speciﬁers and their alternate representations are shown in the following

table. The alternate representations may be used in any mix of upper and lower case.

HP-UX 11i Version 3: September 2010 − 1 − Hewlett-Packard Company 1

Summary of content (4 pages)

PAGE 1
EvmFilter(5) EvmFilter(5) NAME EvmFilter - EVM (Event Management) event filter DESCRIPTION An event filter is a specification of a set of interesting events. Event subscribers use filters to tell the EVM daemon which events they want to receive. For example, one subscriber may be only interested in receiving events reporting hardware errors, while another may want to receive all high-priority events, regardless of what they are reporting. If a subscriber does not set a filter, it will receive no events.
PAGE 2
EvmFilter(5) Operator = > < >= <= != EvmFilter(5) Alternate eq gt lt ge le ne Meaning Equal Greater Than Less Than Greater Than or Equal Less Than or Equal Not Equal An age-specifier comprises an integer value followed immediately by one of the letters w (weeks), d (days), h (hours), m (minutes) or s (seconds). An age-specifier produces an absolute time value relative to the present time, and is most likely to be useful in retrieving historical events through evmget or the event viewer.
PAGE 3
EvmFilter(5) EvmFilter(5) Notes Successive versions of EVM may evolve the filter syntax by adding new keywords or operators. EXAMPLES The following table shows a number of filter specifications, and the interpretation given to each. Filter String "[name *]" "[name myco.*]" "![name myco.*]" "[name ?.?.?]" "[name myco.myapp.*]" "[name myco.myapp]" "[name sys.unix.syslog]" "[name myco.myapp.*.
PAGE 4
EvmFilter(5) "[name sys.unix.evm] & EvmFilter(5) [age < 2d]" All evm events occurring today or yesterday. "[name sys.unix.evm] and [time 2000:6:1-3:*:*:*:*]" All evm events occurring on June 1, 2 or 3, 2000. A eA "none" Passes no events. "0" Passes no events. "all" Passes all events. "1" Passes all events. "@sys" Specifies an indirect filter. The filter string is the default filter contained in a filter file named sys or sys.evf. "@sys:evm" Specifies an indirect filter.