E.4.5 Modifying Commands
By default, the analysis, translation, summary and new binary log file commands all process the system event log. The output from analysis, translation and summary commands is displayed on the screen. You can change these defaults in order to process other binary log files and save the processing results to a file. With some of the commands you can further restrict the events that are processed by filtering the binary log file used for input. The following sections describe how to use these features.
E.4.5.1 Input Files
To change the input file used by a command, use the following modifier:
-f filename
- Where filename indicates the path and name of the desired binary log file.
wsea u ana -f examples/ds20.errlogWhen you are specifying an input file, the following guidelines apply:
- Specifying an input file is optional. If you do not specify either a directory or a file, SEA processes the binary system event log.
- You can use the relative directory structure to specify input files.
- If you specify a directory but no file name, SEA processes all the files with a .errlog, .sys, .zpd, or .evt extension located in the provided directory.
- Multiple filenames can be specified by separating them with spaces.
- You can use wildcards to specify multiple files.
E.4.5.2 Output Files
These output file guidelines do not apply when you are creating a new binary event log. See Section E.4.4 for more details.
To specify an output file, add the following modifier to the end of a command:
> filename
- The modifier creates a text output file. The filename indicates the path and name where you want to save the output.
The following examples show commands that specify output files:
wsea u ana > results.txtE.4.5.3 Filtering
The -a, -o sum, and -b commands enable you to filter a binary event log file and only process a subset of the events. You can include multiple filter statements by using more than one filtering flag in a command. In this case, separate each flag with a space.
Table E–6 describes the DECevent UNIX filtering statements.
Table E–6 Filtering Statements (DECevent UNIX syntax) Filter Statement Description -t "s:date e:date" Filters based on the time the event occurred. No events that occurred before the given start time or after the given end time are processed. The date can be entered in any format supported by Java (for example, dd-mmm-yyyy,hh:mm:ss). You do not need to include the time (hh:mm:ss) with the date. Be aware of the following guidelines:The DECevent UNIX syntax combines the start and end times are in a single filter statement. You can use the keywords YESTERDAY and TODAY. -i keyword-x keyword Filters based on the numeric entry type. You must enter a keyword rather than the actual entry type. See Table E–7 for information on supported keywords. -H name Filters based on the node responsible for generating the event. The name argument is case sensitive. -e s:nn e:nn Filters based on the event's position in the event log. The first event in the file is event index 1. -R Processes the events in reverse order according to the event index number.The following examples show sample commands that use filtering.
Processes events from the system described by ComputerName:
wsea u -a -H ComputerName wsea u -o sum -H ComputerName wsea u -b outputfile.bin -f inputfile.zpd -H ComputerNameProcesses events that occurred before 8:33:57 PM on January 31, 2000:
wsea u -a -t "e:31-Jan-2000,20:33:57" wsea u -o sum -t "e:31-Jan-2000,20:33:57" wsea u -b outputfile.bin -f inputfile.zpd -t "e:31-Jan-2000,20:33:57"Processes all CPU machine check events:
wsea u -a -i cpu wsea u -o sum -i cpu wsea u -b outputfile.bin -f inputfile.zpd -i cpuProcesses all events without an operating system type of 1. The translation command presents the output in reverse chronological order:
wsea u -a -x operating_system=1 -R wsea u -o sum -x operating_system=1 wsea u -b outputfile.bin -f inputfile.zpd -x operating_system=1Processes all the events after the fifteenth event in the log file:
wsea u -a -e s:15 wsea u -o sum -e s:15 wsea u -b outputfile.bin -f inputfile.zpd -e s:15