7.2 Manual Translation
SEA can translate the events in a binary event log and send the results to your computer. This activity is known as manual translation.
On supported platforms, SEA can read and translate error logs produced by any of the supported operating systems. For example, you can use the web interface running on your PC to connect to a Director running on a Tru64 UNIX system to read, translate, and analyze an event file produced previously on an OpenVMS system.
7.2.1 Translating Events
Translation information is available from the CLI and the web interface. See the following chapters for information on translating events:
7.2.2 Translation Defaults
By default some events are not processed. Under normal operation, correctable events are not translated. The events that are usually filtered include:
- Correctable System events (entry types 620 and 630)
- Correctable Error Throttling Notification events
- Miscellaneous events not used by analysis, such as:
- Time Stamp events
- Volume Mount/Dismount events
- Cold Start (System Boot) and Shutdown events
- Software-related events
7.2.3 Translation Report Type
When you translate an event, you can choose between brief and full output. The content differences between full and brief output are defined in the rule sets. Brief output generally only contains the most important data items from the event while full output generally includes most of the data items from the event. Since the exact contents of each report type are defined by the rules used to generate the report, the type of information contained in brief and full reports may vary for different events.
7.2.4 Interpreting Translation Information
Translated events include a timestamp. For information on interpreting this information see Section 7.6.
A translated binary event consists of three layers of information: overall, frame, and field.
7.2.4.1 Overall
The overall binary event contains one or more translated frames of information. There are several types of binary events, each identified by its class name. In addition to the frames, some other information is stored at the overall layer, such as:
- The class name of the binary event (passed to Event Analysis but not displayed in the translated output in the CLI or web interface)
- The "match keys" for the event, a set of strings used in identifying analysis rules that may fire for this event (not displayed in the translated output in the CLI or web interface)
7.2.4.2 Frame
A frame within an event consists of one or more translated fields of information. There are many types of frames, each identified by its label. Each frame type contains a defined set of fields. In addition to the fields, some other information is stored at the frame layer, such as:
7.2.4.3 Field
A field within a frame consists of the following:
- The parent frame of this field
- The field's label, both as an identifier (not shown) and as displayable text
- The field's value (of a type defined by the type of field) which is displayed in text form
7.2.4.4 Typical Frame of a Translated Binary Event
A typical frame of a translated binary event appears as follows:
HPM System Event Frame Subpacket - Version XHPM_Elapsed_Time_Since_Srm_Boot 947 Seconds Since Last Console BootHPM_Event_Info_Block_1 x0040 AB81 0F0F 0010 H-Switch System Event InformationHPM_System_Event_Code[7:0] x10 HS Temperature in
Yellow ZoneHPM_Supplementary_Code[15:8] x0 Supplementary CodeGp0_Valid[16] x1Gp1_Valid[17] x1Gp2_Valid[18] x1Gp3_Valid[19] x1Hs_P0_Valid[24] x1Hs_P1_Valid[25] x1Hs_P2_Valid[26] x1Hs_P3_Valid[27] x1Csb_Master_Ena[32] x13_3_Dcok_2[42] x0 0 = NOT OK if
Regulator 2 is
Installed2_5_Dcok_2[44] x0 0 = NOT OK if
Regulator 2 is
InstalledPll_Dcok_2[46] x0 0 = NOT OK if
Regulator 2 is
InstalledCsb_Address[55:48] x40This frame contains 17 fields. Each field has a single value, such as 947 (decimal) or x10 (hexadecimal, 16 decimal). Some fields are represented as both a Register (HPM_Event_Info_Block_1) containing the complete hexadecimal value, and again as a series of subfields such as HPM_System_Event_Code[7:0]. The [7:0] indicates that bits 0 through 7 of this register comprise this subfield, bit 0 being the least significant bit.
7.2.4.5 Unsupported Entries
Some of the events logged by a system or device are not used by SEA to diagnose hardware failures. The CLI translate command and the event listing in the web interface translate events with many different entry types, including some not used for analysis. However, there are some cases where SEA cannot translate an event:
- If the event type is not supported.
- If the system or device logged incorrect data for a supported entry type, causing it to be unrecognized.
If an event that is not supported or recognized is encountered during translation, an unsupported entry dump is shown in the output. The unsupported entry dump at the end of the event shows the entire event in hexadecimal format, from the first header byte to the last byte of the event.
The following example shows the translated output for an event that was logged incorrectly. The event should have been logged with major class 250 and minor class 0, which SEA would have correctly translated. However, the minor class was 18 and the event was unrecognized. As a result, an unsupported entry dump was generated.
Event: Unknown Combined Entry Type - UNSUPPORTED ENTRY - Major_Class: 250Minor_Class: 18 occurred at Mon, 13 Aug 2001 18:30:36 +0200COMMON EVENT HEADER (CEH) V2.0OS_Type 1 -- Tru64 UNIXHardware_Arch 4 -- AlphaCEH_Vendor_ID 3,564 -- Hewlett-Packard CompanyHdwr_Sys_Type 35 -- GS40/80/160/320 SeriesLogging_CPU 0 -- CPU Logging this EventCPUs_In_Active_Set 24-- Unknown Combined Entry Type -Entry_Type 18,250 UNSUPPORTED ENTRY -Major_Class: 250Minor_Class: 18DSR_Msg_Num 1,969 -- AlphaServer GS320Chip_Type 11 -- EV67 - 21264ACEH_Device 255CEH_Device_ID_0 x0000 0000CEH_Device_ID_1 x0000 0000CEH_Device_ID_2 x0000 0000Unique_ID_Count 3Unique_ID_Prefix 11,248TLV Section of CEHTLV_DSR_String AlphaServer GS320 6/731TLV_OS_Version Tru64 UNIX V5.1 (Rev. 732)TLV_Sys_Serial_Num QBB7.AJK01TLV_Time_as_Local Mon, 13 Aug 2001 18:30:36 +0200TLV_Computer_Name abcd101com.compaq.svctools.desta.services.decomposers.DecompDataException:EXCEPTION: Entry_Type_Support.java, DUNIX_Entry_Type(), No support for thisDUNIX Entry Type... Major_Class is: 250 Minor_Class is: 180000: FE FF FF FF 0C 01 00 00 ?yyy....0008: 48 01 00 00 02 00 00 00 H.......0010: 01 00 04 00 EC 0D 00 00 ....i...0018: 23 00 00 00 00 00 00 00 ........0020: 00 00 00 00 18 00 00 00 ........0028: FA 00 12 00 B1 07 00 00 u.......0030: FF 00 05 00 02 18 00 00 y.......0038: 01 00 00 00 0B 00 00 00 ........0040: 00 00 00 00 00 00 00 00 ........0048: 00 00 00 00 03 00 F0 2B ......?.0050: 00 00 00 00 00 00 00 00 ........0058: 00 00 00 00 00 00 00 00 ........0060: 00 00 00 00 00 00 00 00 ........0068: 00 00 00 00 00 00 00 00 ........0070: 00 00 00 00 00 00 00 00 ........0078: 05 00 00 00 61 00 1F 00 ....a...0080: 43 6F 6D 70 61 71 20 41 Compaq.A0088: 6C 70 68 61 53 65 72 76 lphaServ0090: 65 72 20 47 53 33 32 30 er.GS3200098: 20 36 2F 37 33 31 00 00 .6.731..00a0: 81 00 22 00 43 6F 6D 70 ....Comp00a8: 61 71 20 54 72 75 36 34 aq.Tru6400b0: 20 55 4E 49 58 20 56 35 .UNIX.V500b8: 2E 31 20 28 52 65 76 2E .1..Rev.00c0: 20 37 33 32 29 00 00 00 .732....00c8: C1 00 0B 00 51 42 42 37 A...QBB700d0: 2E 49 4F 52 30 31 00 00 .AJK01..00d8: 41 00 18 00 32 30 30 31 A...200100e0: 30 38 31 33 31 38 33 30 0813183000e8: 33 36 2C 30 30 30 30 32 36.0000200f0: 30 30 00 00 21 01 14 00 00......00f8: 68 73 31 31 30 31 61 00 abcd101.0100: 00 00 00 00 00 00 00 00 ........0108: 00 00 00 00 FA 00 00 00 ....u...0110: 20 00 00 00 6D 63 68 61 ....mcha0118: 6E 31 3A 20 20 6E 6F 64 n1...nod0120: 65 20 32 20 68 61 73 20 e.2.has.0128: 63 6F 6D 65 20 6F 6E 6C come.onl0130: 69 6E 65 0A 00 00 00 00 ine.....0138: 00 00 00 00 E8 00 00 00 ....e...0140: 48 01 00 00 25 7E 3C 5E H.......