unixdev.net


Switch to SpeakEasy.net DSL

The Modular Manual Browser

Home Page
Manual: (OSF1-V5.1-alpha)
Page:
Section:
Apropos / Subsearch:
optional field



evmfilterfile(4)					     evmfilterfile(4)



NAME

  evmfilterfile	- Event	Manager	filter file

SYNOPSIS



  filter {
	  name	     filter_name
	  valuex     filter_value
	  include    filter_element
	  exclude    filter_element
	  title	     filter_title
	  }

DESCRIPTION

  A filter file	contains one or	more filter descriptions, which	can be refer-
  enced	through	certain	EVM commands by	using indirect filter syntax.  An
  indirect filter specifier has	the following form:

  @filename[:filter_name]

  In the previous indirect filter specifier, filename is the name of a filter
  file,	and filter_name	is the name of a filter	contained in the file.	If no
  filter_name is specified, the	first filter in	the file is used.

  By convention, filter	file names should have the suffix .evf.	 If a command
  cannot find the file with the	name as	specified, it appends .evf and tries
  again.

  If a relative	pathname is given for a	file, commands search for the file in
  each location	specified by the EVM_FILTERDIR environment variable if it is
  present.  Otherwise the search is performed in the following standard	loca-
  tions	in turn, stopping as soon as the file is found:

    +  The current working directory

    +  $HOME/.sysman/evmfilters

    +  /var/evm/adm/filters

    +  /usr/share/evm/filters

  Several supplied filter files, containing shortcut filters for many system
  events, can be found in the directory	/usr/share/evm/filters.	 System
  administrators should	place site-specific filter files in
  /var/evm/adm/filters,	and individual users should store private files	in
  $HOME/.sysman/evmfilters.

  The filter file is made up of	a series of keyword/value and keyword/group
  pairs.  Values containing spaces must	be enclosed in double quotes.
  Strings may be continued across a newline by finishing the line with a
  backslash character.	Any portion of a line from an unquoted number sign
  (#) to the end of line is a comment.	Blank lines are	ignored.

  The following	keywords are recognized:

  filter
      Introduces a filter group.

  name filter_name
      Names the	filter.

  value	filter_value
      The filter_value is a string that	conforms to EVM	filter syntax. See
      the EvmFilter(5) reference page for information about filter syntax.

  include filter_element
      Modifies the current filter_value.  See the description of the include
      and exclude keywords below.

  exclude filter_element
      Modifies the current filter_value.  See the description of the include
      and exclude keywords below.

  title	filter_title
      The filter_title is a text string	that describes the purpose of the
      filter.  The title is not	currently used,	but always should be
      included.

  The include and exclude keywords can appear multiple times in	a filter
  group, allowing you to build and maintain a filter in	simple single-line
  increments.  Each filter_element must	be a valid filter string, conforming
  to the syntax	described in the EvmFilter(5) reference	page.  A complete
  filter string	is assembled by	surrounding the	initial	filter with
  parentheses and appending the	filter_elements	to it, separating each with a
  logical OR (for include) or AND NOT (for exclude) operator.  For example:

       value	 "[priority >= 200]"
       include	 "[name	*.mylog]"
       exclude	 "[name	*.oldlog]"

  The previous filter lines are	equivalent to this more	complex	single filter
  line:

       value	 "([priority >=	200]) OR [name *.mylog]	AND NOT	[name *.oldlog]"

  The first line selects all events with a priority of 200 or greater, the
  next modifies	this by	selecting all events from mylog	regardless of their
  priorities, and the last line	excludes all oldlog events regardless of
  their	priorities.

  If you prefer, you can omit the value	command, and build the complete
  filter string	from include and exclude lines.

NOTES

  If you are concerned with allowing your file to be used on other systems
  that support EVM in the future, you should use the built-in macro @SYS_VP@
  in place of the first	two components (sys.unix) of the name of any system
  event.  This will make it unnecessary	to change the file if the other	sys-
  tem uses a different event name prefix.






ENVIRONMENT VARIABLES

  EVM_FILTERDIR
      A	colon-separated	set of directory pathnames to be searched for a
      requested	filter file.  If this variable is present in the environment
      the directories are searched in place of the standard directories.

EXAMPLES

   1.  The following is	an example of a	pair of	entries	in a filter file:


	    # Select all events	posted by myapp, excluding any that
	    # have a priority lower than 200:
	    filter
	    {	name	myapp
		value	"[name myco.myapp.*]"
		exclude	"[pri <	200]"
		title	"All myapp events"
	    }

	    # Select all events	posted by myapp, and important system events:
	    filter
	    {	name	sys_myapp
		value	"[name myco.myapp.*] | \
			      ([name @SYS_VP@.*] & [priority >=	400])"
		title	"System	errors and myapp events"
	    }

   2.  The following command finds and displays	all AdvFS events, using	a
       filter stored in	the supplied filter file
       /usr/share/evm/filter/sys.evf:
	    evmget -f @sys:advfs | evmshow

   3.  Assuming	that the filter	file shown in the first	example	is named
       myapp.evf and is	located	in a standard filter directory,	the following
       command displays	the value of the sys_myapp filter from that file:
	    evmshow -F -f @myapp:sys_myapp



FILES

  $HOME/.sysman/evmfilters/*.evf
      Private filter files.

  /var/evm/adm/filters/*.evf
      Site-specific filter files.

  /usr/share/evm/filters/*.evf
      System filter files.

SEE ALSO

  Commands: evmget(1), evmshow(1), evmwatch(1)

  Routines: EvmFilterCreate(3),	EvmFilterDestroy(3), EvmFilterIsFile(3),
  EvmFilterReadFile(3),	EvmFilterSet(3), EvmFilterTest(3)

  Event	Management: EVM(5)

  EVM Events: EvmEvent(5)

  Event	Filter:	EvmFilter(5)