evmlogger.conf.4 (2010 09)

e
evmlogger.conf(4) evmlogger.conf(4)
See evmlogger (1M) for details of event queuing.
explicit_target
bool_par
If this keyword is not specified, or if it is specified and bool_par has a value of
FALSE, NO,or0 (zero), the forwarder handles events posted through the local dae-
mon. Because EVM currently supports only local connection, this argument should
not be set to TRUE.
suppress
Event suppression as applied to forwarding is similar to event log suppression. The
difference is that event suppression for forwarding limits the number of identical
events that are forwarded over the suppression period. In this case, events which
are eligible for suppression are simply ignored by the forwarder. This feature
reduces the chance of a large volume of mail being sent during a period of high
event activity.
configdir directory
This keyword specifies the path of a directory tree that holds zero or more secondary
configuration files. The directory tree is searched when the logger is started and each time its
configuration is reloaded.
Configuration file names must end with
.conf, and must not begin with a dot (.). Files must
be owned by
bin or root and their file permissions must restrict writing to owner or group.
Symbolic links and subdirectory hierarchies can be used to reference configuration files that
physically are located elsewhere.
After installing, removing or modifying a secondary configuration file, you must run the
evmreload -l command to notify the logger of the change and to request a configuration
reload.
Any number of
configdir entries may be specified in the primary configuration file, but
configdir is not a valid keyword in a secondary configuration file.
The include and exclude Keywords
The
include and exclude keywords can appear multiple times in an eventlog, forward,or
suppress specification, allowing you to build and maintain a filter in simple single-line increments.
Each filter_element must be a valid filter string, conforming to the syntax described in the EvmFilter (5)
reference page. The logger assembles a complete filter string by surrounding the initial filter with
parentheses and appending the filter_element s to it, separating each with a logical
OR (for include
)or
AND NOT (for exclude) operator. For example:
filter "[priority >= 200]"
include "[name *.mylog]"
exclude "[name *.oldlog]"
The previous filter lines are equivalent to this more complex single filter line:
filter "([priority >= 200]) OR [name *.mylog] AND NOT [name *.oldlog]"
The first line selects all events with a priority of 200 or greater, the next modifies this by selecting all
events from mylog regardless of their priorities, and the last line excludes all oldlog events regardless
of their priorities.
If you prefer, you can omit the
filter command, and build the complete filter string from include
and exclude lines.
If no filter, include or exclude lines are supplied for an event log or forwarder, it does not handle any
events.
Keywords
Keywords may be entered in a case-insensitive manner. The allowable strings and the minimum number
of characters is shown in the following table. A minimum of zero (
0) indicates that all characters are
required.
4 Hewlett-Packard Company 4 HP-UX 11i Version 3: September 2010