evmshow(1)

NAME

evmshow — display an EVM event

SYNOPSIS

evmshow [-d | -D | -x] [-t show_template] [-T timespec] [-r | -b item_list] [-c config_file] [-f filter_exprt] [-F] [-k skip_count] [-n show_count] [filename | -]

DESCRIPTION

The evmshow command is EVM's event formatter. It reads raw EVM events either produced by other EVM commands or stored in a file and converts them to display format for viewing. Events are read from stdin if no filename is specified or if filename is -. Formatted output is written to stdout. The evmshow command can be also used as a filter, producing a selected set of raw events as its output.

If none of the -d,-D,-r, or -b options is specified, each event is formatted according to the following rules and written to stdout as a single line of text.

If the -t option is included, the supplied show_template string is used to format the event. If the -t option is omitted but the variable EVM_SHOW_TEMPLATE is present in the environment, the value of the variable is used as the show_template. If no show_template is available, a default value of @@ is used. The @@ is explained in more detail later in this section.

A show_template is a string that contains event data item specifiers of the form @item_name [% width], where item_name is the name of any standard event data item, such as timestamp or priority and width. The width is the minimum number of character spaces the value should occupy. See EvmEvent(5) for a complete list of standard event data items.

Variables defined in EVM events and templates can be included in the show_template by using variable specifiers, which begin with $.

If a show_template is available, evmshow replaces each specifier or variable in the template with the value of the corresponding data item or variable from the event. The produced output string contains only the required items. Any character in show_template is not changed in the output if it is not part of an item specifier or not part of a variable. This method provides a convenient way to insert literal strings, punctuation, and spacing characters.

Tabs and newlines are inserted by using \t and \n, respectively.

For example, a show_template of "@timestamp [@priority] @name" causes each event read by evmshow to be displayed as a single line of text. The line of text is comprised of the date and time, the priority of the event enclosed in brackets, and then the event name.

The output appears as follows:

03-Feb-2000 02:00:00 [200] sys.unix.evm.chmgr.cleanup_done

The special show_template specifier @@ is replaced with the event's formatted text. The formatted text is produced by taking the evmtemplate format data item. Then, any embedded variable specifiers (beginning with $) are replaced with the corresponding variable value, and any data item specifiers are replaced with the corresponding data item.

For example, the show_template of "@timestamp [@priority] @@" results in the following style of display:

03-Feb-2000 02:00:00 [200] EVM channel mgr: Log cleanup completed

Items specified by @ in the show_template that are not present in the event are replaced by the hyphen character -.

An @ or $ character not associated with a valid item name or variable value, respectively, is unchanged in the output. If it is necessary to have an @@ or $ sequence in the output, the @ and $ characters should be escaped with backslashes (\).

If the -T option is specified, each formatted line is prefixed with the event's timestamp value in a format specified by timespec. The timespec can be any string containing specifiers as defined in the Field Descriptors section of the date(1) manpage. For example, the string "%Y/%m/%d %T" yields the date and time in yyyy/mm/dd hh:mm:ss format with a trailing space character separating it from the rest of the line. Use this option instead of specifying @timestamp in the show_template to produce a timestamp in any desired format.

The -f option can be used to specify an EVM filter string, to limit the events that are passed through evmshow. If this option is used, only events that match the filter_expr are output. See the EvmFilter(5) manpage for the filter syntax.

The -r option can be used in combination with the -f, -k, and -n options to make evmshow act as a filter, reading a stream of events and writing only those that meet the selection criteria specified by the other options. Events are output as raw EVM events, so output cannot be directed to a terminal if this option is used.

The -b option can be used to extract one or more data items or variable values from an event stream in their native binary formats. This option is particularly useful for producing a data file from events that contain the required data in variables.

Binary values are written to the output file in the size appropriate to their types -- for example, if a variable named in the item_list is present in an event and has a type of UINT64, 8 bytes of binary data are output. String values are output as arbitrary-length character strings, terminated by a single null byte. If a data item or variable specified in the item_list is not present in an event, nothing is written to the output, and no error is reported. Output cannot be directed to a terminal if the -b option is used.

Options

-c config_file: Uses config_file as the channel configuration file instead of the default file, /etc/evmchannel.conf. The channel configuration file is read when the -d or the -x option is used.
-d: Outputs each event as a full multiline detailed display, using the details function (fn_details) defined for the event in the channel configuration file /etc/evmchannel.conf.
-D: Outputs each event as a multiline dump of the contents of the event. This format does not include explanation text or any additional details about the event.
-r: Does not format events, but outputs each event as a raw (binary) event. This option results in an error if stdout is directed to a terminal device.
-b item_list: Outputs the specified data items or variable values in their native form, ASCII or binary, as appropriate. The item_list must specify one or more standard data items (for example, @timestamp) or variables (for example, $my_variable), separated by commas or tab characters. The list must be enclosed in single quotes if $ or tab characters are used, to protect them from interpretation by the shell. See the DESCRIPTION section for details of the output produced by this option.
-x: Outputs the explanation text for the event. The explanation is obtained using the explanation function ((fn_explain) defined for the event in the channel configuration file /etc/evmchannel.conf.
-t show_template: Outputs each event as a formatted line using the specified show_template. If this option is used in conjunction with -d, -D, or -x, the formatted line is output first followed by the multiline output resulting from the other option.
-T timespec: Outputs the event's timestamp value at the start of each formatted text line using timespec as a template for the timestamp format. See the DESCRIPTION section for details of timespec.
-f filter_expr: Outputs only events that match the filter_expr. See the EvmFilter(5) manpage for the filter syntax.
-F: Echoes any specified filter string to stdout, and terminates. If the filter specified with the -f option refers to a stored filter, the filter is expanded before being displayed. This feature is useful for retrieving filter strings from a file. This option cannot be used in conjunction with any other output format control option.
-k skip_count: Skips the first skip_count events from the input stream before beginning output. If skip_count exceeds the number of events in the input stream, no output is produced.
-n show_count: Stops producing output after show_count events have been output. If show_count exceeds the number of events in the input stream, evmshow outputs all events.

Operands

filename: Reads events from file filename. If filename is omitted, or is specified as -, events are read from stdin.

Notes

1.: The -r and -b options should not be used when output is sent indirectly to a terminal device, such as piping the output of the evmshow command to the more command.
2.: The evmget and evmwatch commands can be made to run evmshow automatically by use of their -A options. See evmget(1) and evmwatch(1) for more information.

EXTERNAL INFLUENCES

Environment Variables

The following environment variable affects the execution of evmshow:

EVM_SHOW_TEMPLATE: This variable contains a string formatted as described for a show_template. If the -d, -D, -t, and -x options are omitted, the string is used as the show_template for output.

RETURN VALUES

The following exit values are returned:

0: Successful completion.
not 0: An error occurred.

EXAMPLES

In the following example, all available events are retrieved and piped to evmshow for formatting. The show_template causes the events to be displayed as timestamp value, followed by the event's priority enclosed in brackets, followed by the formatted event message.

evmget | evmshow -t "@timestamp [@priority]  @@" 

This ksh example displays events in the same way as the previous example, but the show_template is specified in an environment variable, simplifying the evmshow command.

export EVM_SHOW_TEMPLATE="@timestamp [@priority]  @@" 
            evmget | evmshow 

The following example retrieves all available events using evmget, and sorts them into a file. In the evmsort command, the -s option requests that the events be sorted into timestamp order, and the hyphen character at the end of the sort specification indicates that the sort order should be descending. This results in the most recent events appearing first. The evmshow command is then used to display full details (indicated by the -d option) of the first five (most recent) events from the file.

evmget | evmsort -s "@timestamp-" > my_eventfile 
            evmshow -n 5 -d my_eventfile | more 

The following example displays the value of the filter named evm, from the supplied sys filter file. Refer to evmfilterfile(4) for more information about filter files.

evmshow -f "@sys:evm" -F 

The following example retrieves all events and displays them with the timestamp in the form yyyy/mm/dd hh:mm:ss, followed by the priority and the formatted message. See date(1) for details of the timestamp formatting options.

evmget | evmsort | evmshow -T "%Y/%m/%d %T " -t "[@priority]  @@" 

The following example watches for events of priority 600 or greater, and mails them in detailed display format to user jim, with a subject line that identifies the event. In the evmshow command, the -t option produces the subject line as the first line of the output, and the -d option causes evmshow to follow the subject line with a detailed display of the event. The mail command uses the line beginning with Subject: as the subject for the mail message.

evmwatch -f "[priority >= 600]" | 
    evmshow -t "Subject: EVENT [@priority] @@" -d | mail jim 

The following example reads raw EVM events from the file file1 and writes the events that have a priority of 500 or greater to file2, Because the -r option is specified, the output file contains raw EVM events.

evmshow -r -f "[priority >= 500]" file1 > file2 

The following example uses the evmwatch -i option to request a list of all event templates from the EVM daemon, and then uses evmshow to display the name and priority of each template, followed by its explanation text. See evmtemplate(4) for details of event templates.

evmwatch -i | evmshow -t "@name [@priority]" -x | more 

WARNINGS

The evmshow command rejects attempts to output raw events to a terminal device.

FILES

/etc/evmchannel.conf: Location of the EVM channel configuration file

evmshow(1)

Technical documentation

» Table of Contents

» Index

NAME

SYNOPSIS

DESCRIPTION

Options

Operands

Notes

EXTERNAL INFLUENCES

Environment Variables

RETURN VALUES

EXAMPLES

WARNINGS

FILES

SEE ALSO

Commands

Routines

Files

Event Management

EVM Events

Event Filter