2
| : |
A By default, the analysis, translation, summary and new binary log file commands all process the system event log. The output from analysis, translation and summary commands is displayed on the screen. You can change these defaults in order to process other binary log files and save the processing results to a file. With some of the commands you can further restrict the events that are processed by filtering the binary log file used for input. The following sections describe how to use these features.
2
| ( | : |
Many of the commands used in manual mode enable you to specify an input binary event log file. Table2–11 describes how to specify a input file using each syntax.
8 ?
When you are specifying an input file, the following guidelines apply:
e( This rule does not apply when you are using the common syntax filterlog command. Refer to Section2.8 for more information. " /
ca analyze > >
n
f = ca analyze examples\ds20.errlogu h o
0 " ca analyze examples\ " F
* ca analyze examples\ds20.errlog hscir1.zpd . o
s [ ca analyze examples\ds*.errlog e x
r2
| x | n(: | n
A$ With many commands, you can save the results of processing to a file rather than viewing the output on the screen. Table2–12 describes how to specify a output file using each syntax. T2
P  | a ; o Note o |
| d | : L These output file guidelines do not apply when you are creating a new binary event log. Refer to Section2.8 for more details. S O | 3
y2
| u( | : | e
>j Some of the CLI commands enable you to filter a binary event log file and only process a subset of the events. Filtering statements are different depending on the syntax you are using. Table2–13 shows the general rules each syntax uses with filtering.
8 ?
S A E
Table2–14 describes filtering statements for each syntax. O8 Examples – Common Syntax
m
8 ?
T > " s
8 ?
c = n "
r The following examples show sample commands that use filtering. A description of what the filter does follows each example.
e( i Processes events from the system described by ComputerName.N r s i( Processes events that did not occur on the system described by ComputerName that occurred after January 11, 2000., i Z u( E Processes events that occurred before 8:33:57 PM on January 31, 2000." > c ( ] Processes events that occurred no more than four days after the first event in the log file. G G = /( \ Processes events that occurred no more than 35 hours before the last event in the log file. G F y( ' Processes all CPU machine check events.M > A( Processes all events, except those of type 610, 620, and 630. Only the common syntax supports filtering based on specific entry types the other syntaxes must use keywords.e m e A( 2 Processes all events with a type greater than 600. L T >( R Processes all events with a type less than 300 and an operating system of type 3. - " T( Processes all events without an operating system type of 1 or 2. The translation command presents the output in reverse chronological order. > 7 > /( C Processes all the events after the fifteenth event in the log file.a e S 8 Examples – DECevent UNIX a ,V ca x trans filter "computer_name=ComputerName" = O
p ca x filterlog inputfile.zpd outputfile.bin "computer_name=ComputerName" A 7
s y ca x trans filter "computer_name!=ComputerName & date_time_begin=11-Jan-2000" D
G ca x filterlog inputfile.zpd outputfile.bin "computer_name!=ComputerName & date_time_begin=11-Jan-2000"A N 2
n >6 ca x trans filter "date_time_end=31-Jan-2000,20:33:57" i 2
EP ca x filterlog inputfile.zpd outputfile.bin "date_time_end=31-Jan-2000,20:33:57" N r
> k) ca x trans filter "rel_time_days_begin=4"G G A
EC ca x filterlog inputfile.zpd outputfile.bin "rel_time_days_begin=4"e / T
= N) ca x trans filter "rel_time_hours_end=35"r ( .
DC ca x filterlog inputfile.zpd outputfile.bin "rel_time_hours_end=35"F " n
e A' ca x trans filter "entry_type=mchk-cpu", i 2
>A ca x filterlog inputfile.zpd outputfile.bin "entry_type=mchk-cpu"A , i
g ,+ ca x trans filter "entry_type!=610,620,630"/ M >
"E ca x filterlog inputfile.zpd outputfile.bin "entry_type!=610,620,630"< L "
= % ca x trans filter "entry_type>600"T O A
i? ca x filterlog inputfile.zpd outputfile.bin "entry_type>600"T A 9
F 75 ca x trans filter "entry_type<300 & os_type=3"a e f
eO ca x filterlog inputfile.zpd outputfile.bin "entry_type<300 & os_type=3" > D
A i3 ca x trans filter "os_type!=1,2 & sort=revtime"y / B
: ca x filterlog inputfile.zpd outputfile.bin "os_type!=1,2" a e
"% ca x trans filter "entry_index>15"> D T
7? ca x filterlog inputfile.zpd outputfile.bin "entry_index>15", a s
)
The following examples show sample commands that use filtering. A description of what the filter does follows each example.
G
( i Processes events from the system described by ComputerName.> = " O( E Processes events that occurred before 8:33:57 PM on January 31, 2000.> = 2 =( ' Processes all CPU machine check events. e h h( Processes all events without an operating system type of 1. The translation command presents the output in reverse chronological order./ < L /( C Processes all the events after the fifteenth event in the log file.Z A v t8 Examples – DECevent VMSY > O M@ ca u -a -H ComputerName , t
iD ca u -o sum -H ComputerName 3
1` ca u -b outputfile.bin -f inputfile.zpd -H ComputerName E
= A! ca u -a -t e:31-Jan-2000,20:33:57r - Z
B% ca u -o sum -t e:31-Jan-2000,20:33:57= > 7
-A ca u -b outputfile.bin -f inputfile.zpd -t e:31-Jan-2000,20:33:57- Z /
E ca u -a -i cpu =
ca u -o sum -i cpu D T
7. ca u -b outputfile.bin -f inputfile.zpd -i cpu y T
V B ca u -a -x operating_system=1 -R A N
! ca u -o sum -x operating_system=1= n
>= ca u -b outputfile.bin -f inputfile.zpd -x operating_system=10 N r
> N ca u -a -e s:15 c
2 ca u -o sum -e s:15r - /
L/ ca u -b outputfile.bin -f inputfile.zpd -e s:15N r -
n
" The following examples show sample translation commands that use filtering. A description of what the filter does follows each example.
/
a( i Processes events from the system described by ComputerName.p d u s( E Processes events that occurred before 8:33:57 PM on January 31, 2000.< m t P( ' Processes all CPU machine check events.n e c a( Processes all events without an operating system type of 1. The translation command presents the output in reverse chronological order. T P "( C Processes all the events after the fifteenth event in the log file.O = > a8 " Examples – New Common Syntax e O C ca v /tra/nod=ComputerName i 2 #
oC ca v /sum/nod=ComputerName i s E
w_ ca v /bin=outputfile.bin/nod=ComputerName inputfile.zpd/ O
a " ca v /tra/bef=31-Jan-2000,20:33:57 " A
2" ca v /sum/bef=31-Jan-2000,20:33:57 Z r
d" ca v /bin/bef=31-Jan-2000,20:33:57 i N
r O ca v /tra/inc(cpu) E
e ca v /sum/inc(cpu) _ N
e/ ca v /bin=outputfile.bin/inc(cpu) inputfile.zpd0 T E
" n% ca v /tra/EXC(operating_system=1)/revt u
! ca v /sum/EXC(operating_system=1)x l _
> ca v /bin=outputfile.bin/EXC(operating_system=1) inputfile.zpd i t
d " ca v /tra/ent=(s:15) _ n
ca v /sum/ent=(s:15) f i
l1 ca v /bin=outputfile.bin/ent=(s:15) inputfile.zpdN 3
-
e The following examples show sample translation commands that use filtering. A description of what the filter does follows each example.
e
( i Processes events from the system described by ComputerName.< L O t( E Processes events that occurred before 8:33:57 PM on January 31, 2000.p T O y( Processes all CPU machine check and system machine check events. The translation command presents the output in reverse chronological order.t m y =( C Processes all the events after the fifteenth event in the log file.p e h o GC ca n tra node=ComputerName = , i
C ca n sum node=ComputerName c
"j ca n bin input inputfile.zpd out outputfile.bin node=ComputerName C N
f ! ca n tra end=31-Jan-2000,20:33:57" > e
y! ca n sum end=31-Jan-2000,20:33:57o s i
H ca n bin input inputfile.zpd out outputfile.bin end=31-Jan-2000,20:33:57 I
t "+ ca n tra include=mchk_cpu, mchk_sys reverse" > e
r# ca n sum include=mchk_cpu, mchk_sysD 7
&J ca n bin input inputfile.zpd out outputfile.bin include=mchk_cpu, mchk_sys l p
C ca n tra index=(start:15)x l y
/ ca n sum index=(start:15)D
o@ ca n bin input inputfile.zpd out outputfile.bin index=(start:15) N
"
s