evmlogger.conf.4 (2010 09)

e
evmlogger.conf(4) evmlogger.conf(4)
compared with other events that have been posted during the last
period minutes,
ignoring the timestamp, last_timestamp, PID, PPID, event-id and repeat-count data
items. If a matching event is found, and at least
threshold instances of the event
have been written to the log during the
period, the logger does not log the event.
Instead, the logger inserts or updates the
repeat_count
and last_timestamp
data items in the last-logged instance of the event. The suppression is indicated by
the string
[n times] appearing in the message text when the event is displayed,
where n is the repeat_count.
When an individual event becomes eligible for suppression, the suppression is can-
celed automatically after four hours or after supp_period , which ever is the greater
amount of time. The individual event is reinstated when the suppression conditions
occur again. Suppression is canceled automatically when a change of logfile occurs.
Suppression directives are ignored for formatted logs.
The following keywords are recognized in a suppression group:
filter supp_filter_spec
Events selected by this filter are eligible for suppression consideration.
See EvmFilter (5) for the filter syntax.
include filter_element
Modifies the current supp_filter_spec . See the description of the
include and exclude keywords in the The include and exclude Key-
words subsection.
exclude filter_element
Modifies the current supp_filter_spec . See the description of the
include and exclude keywords in the The include and exclude Key-
words subsection.
period supp_period
The period, in minutes, over which events are counted for suppression
consideration.
threshold supp_threshold
The number of instances of an event that is logged during supp_period
before suppression begins.
forward Events meeting the filter specifications are to be forwarded using the command specified.
name forward_name
A name used to identify the forwarding definition.
filter forward_filter_spec
Event forwarding filter specification. Events passing this filter are selected for for-
warding as specified by the forward command . See the EvmFilter (5) manpage
for the filter syntax.
include filter_element
Modifies the current forward_filter_spec . See the description of the include and
exclude keywords in the The include and exclude Keywords subsection.
exclude filter_element
Modifies the current forward_filter_spec . See the description of the include and
exclude keywords in the The include and exclude Keywords subsection.
command forward_command
When an incoming event is selected for handling by this forwarder, and the event is
not eligible for suppression, the logger executes this command, piping the event into
the command’s stdin stream.
maxqueue queue_limit
This keyword limits the number of events that can be queued by a forwarder while
a previous event is being handled by command. If the maximum number of events
is already queued when a new event arrives, the event is ignored by this forwarder.
If not specified, this keyword has a default value of 100. If a value greater than
1000 is specified, the logger automatically limits it to 1000.
HP-UX 11i Version 3: September 2010 − 3 − Hewlett-Packard Company 3