5.10  Modifying Commands

By default, the analysis, translation, summary, and new binary log file commands all process the system event log. In addition, the output from analysis, translation, and summary commands is displayed on screen by default.

You can change the defaults in order to process other binary log files or to save the results to a file. When performing translation, summary, analysis, or creating a new binary log file, you can further restrict the events that are processed by filtering the binary log file used for input.

5.10.1  Input Files

Many commands in manual mode enable you to specify an input binary event log file:

input filename

Where filename indicates the path and name of the input file. The following guidelines apply:

wsea ana
wsea ana input examples\ds20.errlog
wsea analyze input examples
wsea ana input examples\ds20.errlog, examples\hscir1.zpd
wsea ana input samples\ds*.errlog

5.10.2  Output Files

With many commands, you can save the results of processing to a file rather than viewing the output on screen. (These guidelines do not apply when creating a new binary event log as described in Section 5.9. New binary event logs always require an output file name.)

To send the output of an operation to a file, use one of the following parameters:

out filename
outhtml filename

The out parameter creates a text output file and the outhtml parameter creates a HTML output file. The filename indicates the path and name where you want to save the output:

wsea ana out results.txt
wsea ana outhtml results.html

5.10.3  Filtering

The tra, sum, bin, and ana commands enable you to filter a binary event log file and only process a subset of the events. The following general rules apply when you use filters:

Table 5–4 lists the filtering statements available with the new common syntax.

Table 5–4 Filtering Statements (New Common Syntax) 
Filter Statement
Description
begin="date"
since="date"
end="date"
Filters based on the time the event occurred. No events that occurred before the given start time or after the given end time are processed.
The date can be entered in any format supported by Java (for example, dd-mmm-yyyy,hh:mm:ss). You do not need to include the time (hh:mm:ss) with the date.
Be aware of the following additional guidelines:
  • The begin and since statements are equivalent.
  • You can use the keywords YESTERDAY and TODAY.
  • With the begin and since keywords, you can enter a negative integer value to process based on a relative date. For example, entering -3 processes events from the last three days.
  • include=keyword
    exclude=keyword
    Filters based on the numeric entry type. You must enter a keyword rather than the actual entry type. See Table 5–5 for supported keywords.
    node=name
    Filters based on the node responsible for generating the event. The name argument is case sensitive.
    index=nn
    index="start:nn, end:nn"
    Filters based on the event's position in the event log. The first event in the file is event index 1.
    reverse
    Processes the events in reverse order according to the event index number.
    Table 5–5 Event Type Keywords (New Common Syntax) 
    Keyword
    Description
    mchk
    All machine check events.
    cam
    All SCSI entries logged by the CAM logger (199).
    configurations
    Configuration entries (110).
    control_entries
    System startup entries or new error log creation entries (32, 35, 300).
    environmental_entries
    Power entries (mchk-env).
    swxcr
    Entries logged by SWXCR (198).
    machine_checks
    mchks
    Events with machine checking information (mchk).
    operating_system=value
    os=value
    Events with a specific operating system type. The value parameter indicates the numeric code for the desired operating system.
    panic
    Crash restart, system panic, or user panic entries (37, 302).
    software_informationals
    swi
    Events with lastfail, system startup, or system configuration information (volume mounts, volume dismounts, new error logs, timestamp entries) (32, 35, 37, 38, 39, 64, 65, 250, 300, 301, 310).
    osf_entry
    Events logged on a Tru64 UNIX operating system.
    mchk_sys
    All system machine check events.
    mchk_cpu
    All cpu machine check events.
    mchk_env
    All environmental machine check events.

    Examples

    Only process events from the system ComputerName:

    wsea tra node=ComputerName
    wsea sum node=ComputerName
    wsea bin input inputfile.zpd out outputfile.bin node=ComputerName

    Only process events that occurred before 8:33:57 PM on January 31, 2000:

    wsea tra end="31-Jan-2000,20:33:57"
    wsea sum end="31-Jan-2000,20:33:57"
    wsea bin input inputfile.zpd out outputfile.bin end="31-Jan-2000,20:33:57"

    Only process CPU machine check and system machine check events (the translation command presents the output in reverse chronological order):

    wsea tra include="mchk_cpu, mchk_sys reverse"
    wsea sum include="mchk_cpu, mchk_sys"
    wsea bin input inputfile.zpd out outputfile.bin include="mchk_cpu, mchk_sys"

    Only processes events beginning with the fifteenth event in the log file:

    wsea tra index=start:15
    wsea sum index=start:15
    wsea bin input inputfile.zpd out outputfile.bin index=start:15