Tru64 UNIX
DECevent Translation and Reporting Utility User's Guide
Product Version: Tru64 UNIX V5.0 or higher
This software is the property of, and contains confidential technology of, Compaq Computer Corporation. Possession, use, reproduction or transfer of this software and media is strictly prohibited unless authorized in writing by Compaq or a Compaq Authorized Service Provider. Consistent with FAR 12.211 and 12.212, Commercial Computer Software, Computer Software Documentation, and Technical Data for Commercial Items are licensed under vendor's standard commercial license.
Compaq Service materials (including diagnostic Software, hardware and Software tools, and associated documentation) provided by Compaq or a Compaq Authorized Service Provider for its use in the delivery of warranty or other services remain the exclusive property of Compaq. Customer may use such service materials only for activities related to, and only during the term of, such delivery of the applicable warranty or other services, and may not modify or reverse engineer, remove, or transfer the service materials or make them, or any resultant diagnostic or system management data, available to other parties without Compaq's written consent. Upon termination of the applicable warranty or service delivery, Customer will, at Compaq's option, destroy or return all service materials in its possession. Parts replaced by Compaq become the property of Compaq.
COMPAQ and the Compaq logo are registered in U.S. Patent and Trademark Office.
UNIX is a registered trademark in the United States and other countries licensed exclusively through X/Open Company Ltd.
Tru64, DSNlink, OpenVMS, and DECevent
FrameMaker is a registered trademark of Adobe Systems Incorporated.
Other product names mentioned herein may be the trademarks of their respective companies.
Preface
UBPG Publications Manager
ZK03-3/Y32
110 Spit Brook Road
Nashua, NH 03062-9987
-
-
-
-
The printed version of the Tru64 UNIX documentation set is coded with icons on the spines of books to help specific audiences quickly find the books that meet their needs.
Some books in the documentation set help meet the needs of several audiences. For example, the information in some system books is also used by programmers. Consider this when searching for information on specific topics. The Documentation Overview , Glossary, and Master Index provide information on all of the books in the Tru64 UNIX documentation set.
Associated DECevent Documentation
The following documents are associated with the DECevent documentation set.
DECevent Event Management Utility for Tru64 UNIX Installation Guide |
|
DECevent Analysis and Notification Utility for Tru64 UNIX User and Reference Guide |
|
This chapter discusses the DECevent event management utility, the translation of events, analysis and notification, and the DECevent graphical user interface.
The DECevent event management utility provides the interface between a system user and the operating system's event logger. DECevent provides the following two main functions:
Users can request the translation of events from specific event logs into a variety of ASCII reports. The format and contents of the ASCII reports is determined by flags and parameters entered on the command line interface (CLI). The maximum length of the command line is limited to 255 characters.
DECevent translation has the following features:
You also can maintain and customize the user environment with the interactive shell commands.
Tru64 UNIX users need superuser privileges to use the translation and reporting features of DECevent, unless the event log file protection has been changed to allow all users to access the event log files.
The added value function of DECevent provides constant monitoring of a system's event logger. When a significant number of events have occurred so that a DECevent threshold has been crossed, automatic analysis of the event is performed. Automatic analysis can result in the generation of Compaq-specific theory codes that enable Multivendor Customer Services to identify one or more failing field replaceable units (FRU).
Depending upon the theory codes generated from analysis, repair actions may be initiated. Also, depending upon the results of analysis, the proper individuals are notified of the event.
The analysis and notification flags allow the following features:
In addition to automatic analysis and notification, DECevent allows you to perform manual analysis on a user supplied event log. Manual analysis can also result in the generation of Compaq-specific theory codes that enable Multivendor Customer Services to determine a failing FRU.
Tru64 UNIX users need superuser privileges to use the analysis and notification features of DECevent.
A product authorization key (PAK) license is required to utilize the DECevent analysis and notification added-value options. The license is obtained by a Compaq Customer Services engineer through the technical information management architecture (TIMA) and must be installed on your system prior to kit installation. To find the DECevent service PAK in TIMA, select the TIMA tools database and search for "Service PAKS." The title of the tool you need is "Service Tools Product Authorization Key (PAK) Distribution Tool." Refer to TIMA documentation for specifics.
In addition, customers may acquire the PAK information by requesting it from DSNlink hardware support. If DSNlink is installed on your system, type DSNLINK ITS at the system prompt and open the database articles for your operating system. Search for DECEVENT and select the article with the PAK information. You also can refer to the DSNlink for OpenVMS Users's Guide (AA-PBL4D-TE) for further information about DSNlink.
Licenses are verified at run time by the License Management Facility (LMF). For more information on LMF concepts and operation, enter the HELP LICENSE command at the DCL ($) prompt.
In addition to entering commands on the CLI, you have the option of using the DECevent graphical user interface (GUI) to perform translation and analysis. The DECevent Graphical User Interface User's Guide (AA-QE26A-TE) contains all the information necessary for you to use the GUI.
This chapter discusses DECevent help and Tru64 UNIX help.
Help is provided for DECevent commands both through an internal DECevent help utility and through the Tru64 UNIX man utility.
The DECevent hlp flag provides you with help based on a topic string. If the help utility contains information for that topic string, the information is presented. If no information is available for that topic string, a warning message is displayed and you are prompted to enter another topic string. Once help has been presented, you are prompted to enter another topic string. Each help topic can have zero or more subtopics that provide more information on the main topic.
This chapter discusses the Bit-To-Text translation feature, including the necessary privileges, the command verb, translating event files, filtering input events, selecting alternative reports, and translating events as they occur.
The DECevent utility enables you to produce Bit-To-Text ASCII reports derived from system event entries or user supplied event logs. The format of the ASCII report is determined by commands with flags, parameters, and selection keywords appended and entered on the command line interface (CLI). The maximum command line allowed is 255 characters. The DECevent bit-to-text feature performs the following:
Refer to Appendix A for a list of all DECevent utility independent directory files.
Tru64 UNIX users need superuser privileges to use the translation and reporting features of DECevent, unless the event log file protection privileges have been changed to allow all users to read the event log file.
The following DECevent utility command verb allows the translation of system event entries for Tru64 UNIX operating systems:
The -a flag is the default translation flag and does not need to be typed on the command line. Simply typing dia performs the same function as typing dia -a on the command line.
The DECevent utility uses the system event log file as the default input file. For Tru64 UNIX systems, the default file is /usr/adm/binary.errlog.
To produce a translated event report using the built-in defaults, use the following command:
This command by default produces a full report directed to the terminal screen, from the input event log file /usr/adm/binary.errlog.
The -a flag is understood on the command line and does not need to be entered. See Example 3-1 for an example of a full report.
Use the following command to select an alternate input file for translation other than the default system event log file:
In the previous example, errlog.sys has been selected as the alternate file to be translated. You must precede the name of the input file with the -f flag.
DECevent can translate multiple input files, as shown in the following example:
You can use asterisks (*) as wildcards to specify multiple input files. For example, if you want to translate all event log files located in the directory errlog, you could translate errlog_1.sys, errlog_2.sys, and errlog_3.sys with one file name, err*.sys, as shown in the following example:
You also can use the wildcards to translate multiple event log files in multiple directories, as shown in the following example:
To redirect the translated output to a file rather than to a terminal, enter the following command.
In the previous example, errlog_old.rpt is the output file into which the translated event information is written.
To reverse the order of the input event log file being read by the DECevent utility, use the following command:
This command allows events contained in the default system event log file to be displayed in reverse chronological order, with the most recent events displayed first. The default is to display events in forward chronological order. Note that when the -R command is used the entry numbers in the report are listed 1-N.
Use the following command to display events contained in the event log file errorlog.sys in reverse chronological order:
Use the following command to create a smaller binary event log file from a larger event log file, using selection criteria. The following command creates a binary output file:
With this command the binary file error_sublog.bin is created from the default input system event log file. No text report output is generated.
Sometimes you do not want all the information contained in the input event log file. The include ( -i ) and exclude ( -x ) flags allow you to filter input event log files to include or exclude event information.
To include only certain event types in the output report, use the -i flag, as shown in the following example:
% dia -i disk=rz disk=ra92
cpu
In the previous example, only the RZ? disks, RA92? disks, and CPU entries are included in the output report. To exclude certain event types in the output report, use the -x flag, as shown in the following example:
In the previous example, memory entries are excluded from the output report.
Appendix D shows complete listings of all selection criteria for these flags.
Date and time flags allow you to filter events by date and time occurrences. The date and time value is specified in the following format and defined in Table 3-1.
Table 3-1 Date and Time Code Definitions |
|||
To select events between a certain time period on Tru64 UNIX systems, use the -t flag with the s and e parameters. You need both the s and e parameters on the command line to select events between certain time periods, as shown in the following example:
% dia -t s:15-jan-1993
e:20-jan-1993
To include events starting at a certain time for Tru64 UNIX systems, enter the following:
In the previous example, the output report will include all events that occurred after the date and time indicated. To include events before a certain time, enter the following command:
If no time is specified with a date, the default start time is midnight (00:00), and the default end time is 23:59:59.
If the entry position within the event log file is known, a range of entries can be specified. In the following example, only entries 20 through 60 inclusive are translated.
Either the s or e parameter can be omitted, but not both. If the e parameter is omitted, all entries from the starting entry indicated to the end of file are processed. If the s parameter is omitted, all events from the beginning through the end entry are processed.
The following sections describe different ways to produce reports.
To produce a full report, use the -o flag with the full report type, as shown in the following example:
The full report format provides a translation of all available information for each entry in the event log. The full report is the default report type and the flag does not need to be typed on the command line. Example 3-1 shows the format of a full report.
Example 3-1 Full Report Format |
||
|
||
To produce a brief report, use the -o flag with the brief report type, as shown in the following example:
The brief report format provides translation of
key information for each entry in the event log.
Example 3-2 shows
the format for a brief report.
Example 3-2 Brief Report Format |
||
|
||
To produce a terse report, use the -o flag with the terse report type, as shown in the following example:
The terse report format provides binary event
information and displays register values and other ASCII messages in a condensed
format. Example 3-3
shows the format for a terse report.
Example 3-3 Terse Report Format |
|
To produce a summary report, use the -o flag with the summary report type, as shown in the following example:
The summary report format provides a statistical summary of the event entries in the event log.
Example 3-4 shows the format for a summary report.
Example 3-4 Summary Report Format |
|
The -c flag allows events to be monitored as they occur in real time. This enables you to see the translated events immediately on the terminal, or to send translated events to an output file.
To monitor the event logger on Tru64 UNIX systems, enter the following command:
To send translated events to an output file instead of viewing the events on a terminal screen, enter the following command:
The previous command creates a brief report called brief.rpt.
Using the -o brief report type with the -c flag is strongly recommended. Using the -o summary report type with the -c flag is not allowed.
This chapter discusses commands to customize your environments.
You can customize your system environment from within the interactive command shell. The customized settings must be saved before exiting the interactive command shell. Examples of setting and saving customized settings follow.
To save your custom settings, enter the following command:
You must save the customized settings before exiting the interactive command shell or the system default settings become valid again.
To restore the customized settings in the DECevent utility, enter the following command:
To restore default system settings in the DECevent utility enter the following command:
This uses the global settings in the following file:
$DIA_LIBRARY/FMG_GLOBAL_PARAM_ LIBRARY.KNL
Refer to Appendix B for a list of all default system settings.
This chapter discusses the DECevent dia command verb and the four main flags you can append to it.
The dia DECevent command verb allows the translation of an event file residing on a Tru64 UNIX system. DECevent allows you to append four main flags to the dia command verb, each accomplishing different functions on an input event file. The four main flags are described in Table 5-1.
The dia -a command option performs a Bit-To-Text translation on the default system event file or on a user specified file if the -f flag is used. The default system event log file on a Tru64 UNIX operating system is /usr/adm/binary.errlog.
The dia command defaults to the -a flag if no main flag is specified on the command line. The dia -a command is the equivalent of the dia command. The following syntax is used for the dia -a command option:
The following flags can be appended to the dia -a command to further expand the utility function. Refer to Appendix C for a definition of these flags.
-f infile [ ...]
-v
-R
-e [s:start_number][e:end_number]
-i keyword [=val] [ ...]
-x keyword [=val] [ ...]
-H hostname [ ...]
-t [s:time][e:time]
-o output_type
> outfile
The dia -a command allows you to use the optional infile parameter. This allows you to choose one or more alternative input event files for translation. Reporting is done in sequential order. If you do not supply a file name for this parameter, the default event file is used. The default event file is defined as either the default system event log for each operating system, or a file specified using the set evt command.
The default system event log file on a Tru64 UNIX system is /usr/adm/binary.errlog.
The dia -b command allows you to copy all or part of a log file into another binary output file. This command is typically used in conjunction with the -i and -x flags and with selection keywords to select only those entries of interest. The binfile is the output file created from the -b command and is not optional.
The following syntax is used for the dia -b command option:
dia -b binfile [-f infile[
...]]
The following list presents the valid flags and parameters for the dia -b command. Refer to Appendix C for definitions of these flags.
-f infile [ ...]
-v
-R
-j [rejfile]
-e [s:start_number][e:end_number]
-i keyword [=val] [ ...]
-x keyword [=val] [ ...]
-H hostname [ ...]
-t [s:time][e:time]
The dia -c command reads and displays events as they occur directly from the system event logger. The output goes to the user terminal by default unless it is redirected to a file.
The following syntax is used for the dia -c command option:
A special file is created in the /tmp directory when you use the dia -c command: DECevent_MbxYYYY, where YYYY is a four digit number assigned by the system.
Do not delete this file while DECevent is running. These files are deleted upon normal termination of the dia -c command.
The following list presents the valid flags and parameters for the dia -c command. Refer to Appendix C for definitions of these flags.
-i keyword [=val] [ ...]
-x keyword [=val] [ ...]
-o output_type
> outfile
The dia -d command provides a brief report type followed by a dump of a generic buffer. The following syntax is used for the dia -d command option:
The following list presents the valid flags and parameters for the dia -d command. Refer to Appendix C for definitions of these flags.
-f infile [ ...]
-v
-R
-e [s:start_number][e:end_number]
-i keyword [=val] [ ...]
-x keyword [=val] [ ...]
-H hostname [ ...]
-t [s:time][e:time]
> outfile
The dia -d command allows you to use the optional [infile] parameter. This allows you to choose one or more alternative input event files for translation. Reporting is done in sequential order. If you do not supply a file name for this parameter, the default event file is used. The default file is defined as either the default system event log for each operating system, or a file specified using the set evt command.
The default system event log file on a Tru64 UNIX system is /user/adm/binary.errlog.
This chapter discusses the DECevent ls commands.
The DECevent ls commands allow you to display all requested rulesets listed in the specified knowledge library. Rulesets contain instructions necessary for the translation of events. A knowledge library contains the rulesets.
Table 6-1 lists each DECevent ls command.
Table 6-1 The ls Commands |
|
The DECevent ls evt command lists all event rulesets contained in $DIA_LIBRARY/FMG_ETC__DEF_RULE_LIB.KNL.
The following syntax is used for the ls evt command:
This command provides a directory listing of the rulesets in the event knowledge library similar to the one shown in Example 6-1.
Example 6-1 Event Knowledge Library List |
||
The DECevent ls can command allows you to list all canonical rulesets necessary for formatting a report.
The DECevent ls can command allows you to list all canonical rulesets contained in $DIA_LIBRARY/FMG_RPT__DEF_RULE_LIB.KNL.
The following syntax is used for the ls can command:
This command provides a directory listing of the rulesets in the canonical knowledge library similar to the example shown in Example 6-2.
Example 6-2 Canonical Knowledge Library List |
||
|
||
This chapter discusses the DECevent shw commands.
The DECevent shw commands allow you to view a specific item, depending on the specific shw command issued. Table 7-1 lists each DECevent shw command.
Table 7-1 The shw Commands |
|
Shows all values associated with selection information for the -i and -x flags. |
|
The DECevent shw sel command shows all keywords associated with selection information for the -i and -x flags.
The following syntax is used for the shw sel command:
This command gives a list of selection information similar to the one in Example 7-1.
Example 7-1 Selection Information List |
||
|
||
When the shw sel command is issued with the [selection] parameter, the command shows only the single entry for the [selection] chosen. The [selection] must be spelled out in full and it must be a valid selection type.
The following syntax is used for the shw sel command with a [selection] parameter:
The [selection] parameter must be one of the selection keys shown in Example 7-1. These keys are displayed when the shw sel command has been issued.
The following is an example of the shw sel command with a specific [selection] parameter:
% dia shw sel
operating_systems
Abbreviation of the [selection] parameter is not allowed.
This shw sel command gives the message shown in Example 7-2.
Example 7-2 A shw sel environmental_entries Command Example |
||
|
||
The DECevent shw set command shows all possible setting parameters.
The following syntax is used for the shw set command:
A partial output from this command is shown in Example 7-3.
Example 7-3 Current Settings Information |
|
When the shw set command is issued with a [setting] parameter, the command shows only the single entry for the setting chosen.
The following syntax is used for the shw set command with a single [setting] parameter:
The [setting] parameter must be one of the valid setting names displayed when the shw set command was issued and must be entered in upper case.
The following is an example of the shw set [setting] command:
This command displays the message shown in Example 7-4.
Example 7-4 A shw set default_report Command Example |
|
This chapter discusses the -int flag.
The -int flag allows you to enter the DECevent interactive command shell. When you are in the DECevent interactive command shell, the dia> prompt is displayed on the screen. Chapter 4 provides a basic overview of the interactive command shell.
All commands valid from the CLI also are valid from the interactive command shell without first entering the dia command verb. Some commands, such as the set commands, are valid only from within the interactive command shell and may not be entered from the CLI. If -int is specified on the command line, subsequent commands are ignored.
To enter the interactive command shell from a Tru64 UNIX system, at the system prompt, enter the following command:
The DECevent interactive command shell prompt, dia> , appears. The format for entering a command at the dia> prompt is the following:
aaa is the command valid
from the DECevent interactive command shell.
xxxx is the specific subject the command applies
to.
yyyy is the parameter associated with the command.
Correct interactive command syntax is explained further in this chapter.
To exit from the interactive command shell, type
exit at the
dia> prompt followed by a carriage return.
Although there are no specific qualifiers or parameters for the -int flag, all commands valid from the CLI are valid from within the interactive command shell.
The following examples show how to enter the interactive command shell, how to issue a command from within the interactive command shell, and how to exit the interactive command shell.
Example: Entering the Interactive Command Shell
To enter the interactive command shell, enter the following command at the system prompt:
The DECevent interactive command shell prompt, dia> , then appears.
Example: Issuing a Command from the Interactive Command Shell
The following command shows how to issue a set locale command from dia> , the DECevent interactive prompt:
All settings must be entered in uppercase letters.
The set loc command is described in detail in Section 8.2.2.
Example: Saving Settings from within the Interactive Command Shell
The results of all set commands must be saved before exiting the interactive command shell or the default settings once again become valid upon exiting the interactive command shell. To save settings, enter the following command at the dia> prompt:
Example: Exiting the Interactive Command Shell
To exit the interactive command shell, enter the following command at dia> , the interactive prompt:
The set , sav , and res commands work only from within the interactive command shell.
Table 8-1 lists each set command as well as the sav and res commands. Underlined parameters imply required input.
The set evt command allows you to select an event log file from which event reports are formatted. This allows you, in the interactive command shell, to use an event log other than the default system event log without specifying the file name on all subsequent commands. Before exiting the interactive command shell, you must save this setting or system default settings become valid once again.
The following syntax is used for the set evt command:
The file parameter is the name and path of the event log file used for formatting the report. You must enter a file parameter with this command.
The following is an example of a set evt command:
dia> set evt
/usr/users/binlog/binlog_oscar
Set commands should be saved with the sav command. Refer to Section 8.2.4 for information of saving set command functions.
The set loc command allows you to override the locale file previously set for the current system. This is done for internationalization reasons so natural language conventions can be added in the future.
Only the AMERICAN_ENGLISH locale file will be supported for DECevent. However, documentation will be provided describing how to create new locale files.
The following syntax is used for the set loc command:
The locale parameter is a string defining the local language preferences available. An example is AMERICAN_ENGLISH. You must provide a locale parameter with this command.
The following sections describe the necessary DECevent directories and files. The directories must contain the files listed for DECevent to perform correctly.
DECevent interactive help physically resides in
the
The environmental variable DIA_LIBRARY is defined
to be /var/DIA. The directory var/DIA has symbolic links to files that reside
in the directory /var/opt/DIA230/DIA. Files that reside in the directory
/var/opt/DIA230/DIA are linked to /usr/opt/DIA230/lib/DIA. The files described
in Table A-1 reside
in the
In addition to the files in the DECevent independent directory, a knowledge library file, FMG_LOCAL_PARAM_LIBRARY.KNL, is created in your home directory to be used when customized settings are saved. This library is created just by using DECevent. You need not be logged into your local directory for this library to be created.
Enter ls $HOME/*.KNL at the system prompt to see the library in your local directory.
The following lists the system settings displayed with the shw set command and their default values for Tru64 UNIX.
|
|
User-Modifiable System Settings
Currently, the only user-modifiable system settings are the following:
Refer to Chapter 8 for instructions on how to change user modifiable settings and to Chapter 7 for information on how to show these settings.
Table C-1 shows all the DECevent flags and qualifiers that are available for the Bit-To-Text translation of events.
All commands used at the command line interface also are valid within the interactive command shell. The following commands are valid only from within the interactive command shell:
This appendix contains descriptions and examples of all selection keywords associated with Bit-To-Text translation of events.
The -i qualifier allows you to include event entries meeting the selection criteria specified. Only event entries meeting the selection criteria are included in the output.
Syntax for the -i command is the following:
The val field is an optional field used to further define the selection keyword. For example, the keyword disk can be further defined with the value RZ23.
All keyword values must be entered in upper case.
In the previous example, all entries selected from the event log are disk entries. The output is directed to the filename.out file.
%dia -i disk=RZ23 >
filename.out
In the previous example only RZ23 entries are selected from the event log. The output is directed to a file named filename.out. You can combine -x and -i qualifiers in the same command line to further narrow the selection scope. An -i -i combination or an -x -x combination will result in an error.
Refer to Section D.4 for examples of using different include commands, and Section D.3 for the definitions of the selection keywords.
The -x qualifier allows you to exclude event entries meeting the criteria specified. Only event entries meeting the criteria are excluded from the output.
Syntax for the -x command is the following:
The val field is an optional field used to further define the selection keyword. For example, the keyword disk can be further defined with the value RZ23.
All keyword values must be entered in upper case.
In the previous example all entries in the log are selected except disk entries. The output is directed to the filename.out file.
%dia -x disk=RZ23 >
filename.out
In the previous example only RZ23 disk entries are excluded from the log. The output is directed to the filename.out file.
You can combine -x and -i qualifiers in the same command line to further narrow the selection scope. An -i -i combination or an -x -x combination will result in an error.
Refer to Section D.4 for examples of using different exclude commands, and Section D.3 for the definitions of the selection keywords.
You can use all keywords to exclude or include information from the output. The keywords and their definitions are listed in this section. The abbreviated forms of the keywords, bolded in the table, also are acceptable. For example, you may exclude environmental_entries with the following command:
The following subsections provide -i and -x qualifier examples.
The following example includes only power entries:
The following example includes power, cpu, and tape entries:
The following example gives an error because two -i flags are not allowed:
The following example excludes power entries and places the output in a file called outfile:
The following example excludes power, cache and cpu entries and places the output in a file called outfile:
%dia -x pwr cpu cache>
outfile
The following example gives an error because two -x flags are not allowed:
The following example includes all power entries that are not cpu entries:
The following example includes all power entries and excludes entries from node cxaiag that are not cpu entries:
The following example includes all power and io_subsystem entries that are not cpu entries:
%dia -i pwr io_subsystem -x
cpu
The following example includes all power entries that are not cpu or software_informational entries:
The following example includes all power entries and excludes from the node cxaiag that are not cpu or software_informational entries: