evmfilterfile(4)evmfilterfile(4)NAMEevmfilterfile - Event Manager filter file
SYNOPSIS
filter {
name filter_name
valuex filter_value
include filter_element
exclude filter_element
title filter_title
}
DESCRIPTION
A filter file contains one or more filter descriptions, which can be
referenced through certain EVM commands by using indirect filter syn‐
tax. An indirect filter specifier has the following form: @file‐
name[:filter_name]
In the previous indirect filter specifier, filename is the name of a
filter file, and filter_name is the name of a filter contained in the
file. If no filter_name is specified, the first filter in the file is
used.
By convention, filter file names should have the suffix .evf. If a
command cannot find the file with the name as specified, it appends
.evf and tries again.
If a relative pathname is given for a file, commands search for the
file in each location specified by the EVM_FILTERDIR environment vari‐
able if it is present. Otherwise the search is performed in the fol‐
lowing standard locations in turn, stopping as soon as the file is
found: The current working directory $HOME/.sysman/evmfilters
/var/evm/adm/filters /usr/share/evm/filters
Several supplied filter files, containing shortcut filters for many
system events, can be found in the directory /usr/share/evm/filters.
System administrators should place site-specific filter files in
/var/evm/adm/filters, and individual users should store private files
in $HOME/.sysman/evmfilters.
The filter file is made up of a series of keyword/value and key‐
word/group pairs. Values containing spaces must be enclosed in double
quotes. Strings may be continued across a newline by finishing the
line with a backslash character. Any portion of a line from an
unquoted number sign (#) to the end of line is a comment. Blank lines
are ignored.
The following keywords are recognized: Introduces a filter group.
Names the filter. The filter_value is a string that conforms to EVM
filter syntax. See the EvmFilter(5) reference page for information
about filter syntax. Modifies the current filter_value. See the
description of the include and exclude keywords below. Modifies the
current filter_value. See the description of the include and exclude
keywords below. The filter_title is a text string that describes the
purpose of the filter. The title is not currently used, but always
should be included.
The include and exclude keywords can appear multiple times in a filter
group, allowing you to build and maintain a filter in simple single-
line increments. Each filter_element must be a valid filter string,
conforming to the syntax described in the EvmFilter(5) reference page.
A complete filter string is assembled by surrounding the initial filter
with parentheses and appending the filter_elements to it, separating
each with a logical OR (for include) or AND NOT (for exclude) operator.
For example:
value "[priority >= 200]" include "[name *.mylog]" exclude
"[name *.oldlog]"
The previous filter lines are equivalent to this more complex single
filter line:
value "([priority >= 200]) OR [name *.mylog] AND NOT [name *.old‐
log]"
The first line selects all events with a priority of 200 or greater,
the next modifies this by selecting all events from mylog regardless of
their priorities, and the last line excludes all oldlog events regard‐
less of their priorities.
If you prefer, you can omit the value command, and build the complete
filter string from include and exclude lines.
NOTES
If you are concerned with allowing your file to be used on other sys‐
tems that support EVM in the future, you should use the built-in macro
@SYS_VP@ in place of the first two components (sys.unix) of the name of
any system event. This will make it unnecessary to change the file if
the other system uses a different event name prefix.
ENVIRONMENT VARIABLES
A colon-separated set of directory pathnames to be searched for a
requested filter file. If this variable is present in the environment
the directories are searched in place of the standard directories.
EXAMPLES
The following is an example of a pair of entries in a filter file:
# Select all events posted by myapp, excluding any that # have a
priority lower than 200: filter { name myapp
value "[name myco.myapp.*]"
exclude "[pri < 200]"
title "All myapp events" }
# Select all events posted by myapp, and important system
events: filter { name sys_myapp
value "[name myco.myapp.*] | \
([name @SYS_VP@.*] & [priority >= 400])"
title "System errors and myapp events" } The following
command finds and displays all AdvFS events, using a filter
stored in the supplied filter file /usr/share/evm/fil‐
ter/sys.evf: evmget -f @sys:advfs | evmshow Assuming that the
filter file shown in the first example is named myapp.evf and is
located in a standard filter directory, the following command
displays the value of the sys_myapp filter from that file:
evmshow -F -f @myapp:sys_myapp
FILES
Private filter files. Site-specific filter files. System filter
files.
SEE ALSO
Commands: evmget(1), evmshow(1), evmwatch(1)
Routines: EvmFilterCreate(3), EvmFilterDestroy(3), EvmFilterIsFile(3),
EvmFilterReadFile(3), EvmFilterSet(3), EvmFilterTest(3)
Event Management: EVM(5)
EVM Events: EvmEvent(5)
Event Filter: EvmFilter(5)evmfilterfile(4)