| : |
( By default, the analysis, translation, summary and new binary log file commands all process the system event log. The output from analysis, translation and summary commands is displayed on the screen. You can change these defaults in order to process other binary log files and save the processing results to a file. With some of the commands you can further restrict the events that are processed by filtering the binary log file used for input. The following sections describe how to use these features.
2
| ( | : |
- ( Specifying an input file is optional. If you do not specify either a directory or a file, Compaq Analyze processes the binary system event log. An example of a command without any input file criteria is shown here:
- ( You can use the relative directory structure to specify input files. Thus, if you were in the C:\program files\compaq\svctools\ca directory and you wanted to analyze the ds20.errlog binary event log located in the C:\program files\compaq\svctools\ca\examples directory, you could enter the following command:F
- ( oIf you specify a directory but no file name, Compaq Analyze processes all the files with a .errlog, .sys, .zpd, or .evt extension located in the provided directory. An example of a command that only indicates a directory is shown here:a e
- ( f Multiple filenames can be specified by separating them with spaces, as shown in the following example: i
- ( &You can use wildcards to specify multiple files. In the example shown here, all the files located in the \examples directory with a name that starts with ds and an .errlog extension are analyzed: A
( Many of the commands used in manual mode enable you to specify an input binary event log file. Table2-11 describes how to specify a input file using each syntax.
8 ?
( F When you are specifying an input file, the following guidelines apply:
( This rule does not apply when you are using the common syntax filterlog command. Refer to Section2.8 for more information.
ca analyze
o t ca analyze examples\ds20.errlog+ a z
P . ca analyze examples\ ' v
, ;* ca analyze examples\ds20.errlog hscir1.zpd u A
l ' ca analyze examples\ds*.errlog t
2
| D( | : |
( With many commands, you can save the results of processing to a file rather than viewing the output on the screen. Table2-12 describes how to specify a output file using each syntax.
n
e2
H  | o ; e Note f | s
| : E These output file guidelines do not apply when you are creating a new binary event log. Refer to Section2.8 for more details. | G
8 ?
| \ |
g2
| f | s(: | E
E( Some of the CLI commands enable you to filter a binary event log file and only process a subset of the events. Filtering statements are different depending on the syntax you are using. Table2-13 shows the general rules each syntax uses with filtering.
f
8 ?
| 6 |
B( Y Table2-14 describes filtering statements for each syntax.l
>
8 ?
| A |
8 ?
| " |
O8 Examples - Common Syntax g
( { The following examples show sample commands that use filtering. A description of what the filter does follows each example.A
>
C( i Processes events from the system described by ComputerName.n S 2 ( Processes events that did not occur on the system described by ComputerName that occurred after January 11, 2000.O > N #( E Processes events that occurred before 8:33:57 PM on January 31, 2000./ B / ( ] Processes events that occurred no more than four days after the first event in the log file. Z P e o( \ Processes events that occurred no more than 35 hours before the last event in the log file. = N( ' Processes all CPU machine check events.L i O( Processes all events, except those of type 610, 620, and 630. Only the common syntax supports filtering based on specific entry types the other syntaxes must use keywords." F A A( 2 Processes all events with a type greater than 600. = c( R Processes all events with a type less than 300 and an operating system of type 3. > 7( Processes all events without an operating system type of 1 or 2. The translation command presents the output in reverse chronological order. r s ,( C Processes all the events after the fifteenth event in the log file.= > M ,8 Examples - DECevent UNIX G N( { The following examples show sample commands that use filtering. A description of what the filter does follows each example.w > eV ca x trans filter "computer_name=ComputerName" G A
,p ca x filterlog inputfile.zpd outputfile.bin "computer_name=ComputerName" F "
2 9y ca x trans filter "computer_name!=ComputerName & date_time_begin=11-Jan-2000"L V P
N ca x filterlog inputfile.zpd outputfile.bin "computer_name!=ComputerName & date_time_begin=11-Jan-2000"r - Z
n E6 ca x trans filter "date_time_end=31-Jan-2000,20:33:57" > T
OP ca x filterlog inputfile.zpd outputfile.bin "date_time_end=31-Jan-2000,20:33:57" B
O A) ca x trans filter "rel_time_days_begin=4" a e
C ca x filterlog inputfile.zpd outputfile.bin "rel_time_days_begin=4"= E
= ) ca x trans filter "rel_time_hours_end=35"N 9 Y
"C ca x filterlog inputfile.zpd outputfile.bin "rel_time_hours_end=35"c a
L' ca x trans filter "entry_type=mchk-cpu"0 a
A ca x filterlog inputfile.zpd outputfile.bin "entry_type=mchk-cpu"O A =
> + ca x trans filter "entry_type!=610,620,630"> = D
7E ca x filterlog inputfile.zpd outputfile.bin "entry_type!=610,620,630"h T
P t% ca x trans filter "entry_type>600" c
o? ca x filterlog inputfile.zpd outputfile.bin "entry_type>600"G G A
F /5 ca x trans filter "entry_type<300 & os_type=3" # A
eO ca x filterlog inputfile.zpd outputfile.bin "entry_type<300 & os_type=3"r - >
r i3 ca x trans filter "os_type!=1,2 & sort=revtime"1 Y >
>: ca x filterlog inputfile.zpd outputfile.bin "os_type!=1,2" V P
M % ca x trans filter "entry_index>15"T O A
N? ca x filterlog inputfile.zpd outputfile.bin "entry_index>15"A 9
"
t
e( i Processes events from the system described by ComputerName. o o G( E Processes events that occurred before 8:33:57 PM on January 31, 2000.D G P >( ' Processes all CPU machine check events.r - " >( Processes all events without an operating system type of 1. The translation command presents the output in reverse chronological order. # A B( C Processes all the events after the fifteenth event in the log file.n > / >8 Examples - DECevent VMS0 m g( The following examples show sample translation commands that use filtering. A description of what the filter does follows each example.l ,@ ca u -a -H ComputerName = >
D ca u -o sum -H ComputerName "
Z` ca u -b outputfile.bin -f inputfile.zpd -H ComputerName A 7
s T! ca u -a -t e:31-Jan-2000,20:33:57P = >
% ca u -o sum -t e:31-Jan-2000,20:33:57e O >
NA ca u -b outputfile.bin -f inputfile.zpd -t e:31-Jan-2000,20:33:57 D
T N ca u -a -i cpu " >
O ca u -o sum -i cpu L
Y. ca u -b outputfile.bin -f inputfile.zpd -i cpu n
D / ca u -a -x operating_system=1 -R > 7
Z! ca u -o sum -x operating_system=1t T
A= ca u -b outputfile.bin -f inputfile.zpd -x operating_system=1- Z e
- n ca u -a -e s:15> v l
/ ca u -o sum -e s:15T O A
N/ ca u -b outputfile.bin -f inputfile.zpd -e s:15S / /
p
s( i Processes events from the system described by ComputerName.c a F ( E Processes events that occurred before 8:33:57 PM on January 31, 2000.s i y t( ' Processes all CPU machine check events.e O # ( Processes all events without an operating system type of 1. The translation command presents the output in reverse chronological order. P e ( C Processes all the events after the fifteenth event in the log file./ > N t8 Examples - New Common Syntax o( The following examples show sample translation commands that use filtering. A description of what the filter does follows each example.T > IC ca v /tra/nod=ComputerName r < r
>C ca v /sum/nod=ComputerName t i e
t_ ca v /bin=outputfile.bin/nod=ComputerName inputfile.zpde = c
t i" ca v /tra/bef=31-Jan-2000,20:33:57
t" ca v /sum/bef=31-Jan-2000,20:33:57 f c
i" ca v /bin/bef=31-Jan-2000,20:33:57 n 0
t ca v /tra/inc(cpu) e a
C ca v /sum/inc(cpu) " t
:/ ca v /bin=outputfile.bin/inc(cpu) inputfile.zpdI t
z >% ca v /tra/EXC(operating_system=1)/rev M r
>! ca v /sum/EXC(operating_system=1)t e m
>> ca v /bin=outputfile.bin/EXC(operating_system=1) inputfile.zpd f r
/ ca v /tra/ent=(s:15) o 5
N ca v /sum/ent=(s:15) l p
_1 ca v /bin=outputfile.bin/ent=(s:15) inputfile.zpd" E
=
>
( i Processes events from the system described by ComputerName.F " t C( E Processes events that occurred before 8:33:57 PM on January 31, 2000.r - O .( Processes all CPU machine check and system machine check events. The translation command presents the output in reverse chronological order.a c d ( C Processes all the events after the fifteenth event in the log file.T I aC ca n tra node=ComputerName > I t
tC ca n sum node=ComputerName N 4 O
>j ca n bin input inputfile.zpd out outputfile.bin node=ComputerName e r
s t! ca n tra end=31-Jan-2000,20:33:57/ / B
"! ca n sum end=31-Jan-2000,20:33:57s v
H ca n bin input inputfile.zpd out outputfile.bin end=31-Jan-2000,20:33:57 ; 3
B N+ ca n tra include=mchk_cpu, mchk_sys reversee n
m# ca n sum include=mchk_cpu, mchk_sysC N M
=J ca n bin input inputfile.zpd out outputfile.bin include=mchk_cpu, mchk_sys > l
u i ca n tra index=(start:15) C N
ca n sum index=(start:15)T E
f@ ca n bin input inputfile.zpd out outputfile.bin index=(start:15) E
4
P
F
A
3
8 c | Title Pagea | Prevez | Nextph | onMouseOut="self.status=''; return true">Table of Contents | Service Tools[ | Index |p n