5.10.3 Filtering
The tra, sum, bin, and ana commands enable you to filter a binary event log file and only process a subset of the events. The following general rules apply when you use filters:
- Multiple filter statements are allowed when separated by a comma and space.
- Abbreviations are allowed for filter parameters. You only need the minimum number of letters to uniquely identify a parameter. For example, index could be abbreviated as ind.
- On Windows systems, any argument that includes a comma must be enclosed in quotation marks. This includes arguments that contain a date.
Table 5–4 lists the filtering statements available with the new common syntax.
Table 5–4 Filtering Statements (New Common Syntax) Filter Statement Description begin="date"since="date"end="date" Filters based on the time the event occurred. No events that occurred before the given start time or after the given end time are processed.The date can be entered in any format supported by Java (for example, dd-mmm-yyyy,hh:mm:ss). You do not need to include the time (hh:mm:ss) with the date.Be aware of the following additional guidelines:The begin and since statements are equivalent. You can use the keywords YESTERDAY and TODAY. With the begin and since keywords, you can enter a negative integer value to process based on a relative date. For example, entering -3 processes events from the last three days. include=keywordexclude=keyword Filters based on the numeric entry type. You must enter a keyword rather than the actual entry type. See Table 5–5 for supported keywords. node=name Filters based on the node responsible for generating the event. The name argument is case sensitive. index=nnindex="start:nn, end:nn" Filters based on the event's position in the event log. The first event in the file is event index 1. reverse Processes the events in reverse order according to the event index number.Only process events from the system ComputerName:
wsea tra node=ComputerName wsea sum node=ComputerName wsea bin input inputfile.zpd out outputfile.bin node=ComputerNameOnly process events that occurred before 8:33:57 PM on January 31, 2000:
wsea tra end="31-Jan-2000,20:33:57" wsea sum end="31-Jan-2000,20:33:57" wsea bin input inputfile.zpd out outputfile.bin end="31-Jan-2000,20:33:57"Only process CPU machine check and system machine check events (the translation command presents the output in reverse chronological order):
wsea tra include="mchk_cpu, mchk_sys reverse" wsea sum include="mchk_cpu, mchk_sys" wsea bin input inputfile.zpd out outputfile.bin include="mchk_cpu, mchk_sys"Only processes events beginning with the fifteenth event in the log file:
wsea tra index=start:15 wsea sum index=start:15 wsea bin input inputfile.zpd out outputfile.bin index=start:15