|HP-UX Reference > E
EvmFilter(5)HP-UX 11i Version 3: February 2007
EvmFilter — EVM (Event Management) event filter
An event filter is a specification of a set of interesting events. Event subscribers use filters to tell the EVM daemon which events they want to receive. For example, one subscriber may be only interested in receiving events reporting hardware errors, while another may want to receive all high-priority events, regardless of what they are reporting. If a subscriber does not set a filter, it will receive no events.
The Event Viewer and some of the EVM user commands also use filters to select events for viewing or processing.
A filter is an ASCII character string. It can be very simple or arbitrarily complex. Complex filters are created by combining simple filters.
A simple filter has the following format:
[keyword expr] | all | 1 | none | 0
The format of expr is specific to the type of filter. The left and right square brackets ([ and ]) are required. Keywords may be specified in any mix of upper and lower case, and where the underscore character (_) is included in a full-length keyword (as in host_name), it may be omitted. Keywords may be abbreviated, and in the following paragraphs the minimum abbreviation for each is indicated by upper-case letters.
Possible values for keyword and the associated expr are as follows:
The available equality-operator specifiers and their alternate representations are shown in the following table. The alternate representations may be used in any mix of upper and lower case.
An age-specifier comprises an integer value followed immediately by one of the letters w (weeks), d (days), h (hours), m (minutes) or s (seconds). An age-specifier produces an absolute time value relative to the present time, and is most likely to be useful in retrieving historical events through evmget or the event viewer. It is not meaningful to use an age-specifier when setting a filter for use by the EVM logger or evmwatch.
If a period of weeks is specified, the period is converted to days by multiplying it by 7. When calculating an absolute time for an age specified in weeks or days, the first day is always regarded as the period from the previous midnight until the present time, and earlier days are counted from midnight to midnight. For example, if an age-specifier of 1d is given, events are selected relative to 12:00 a.m. on the same day. A value of 2d would select events relative to 12:00 a.m. the previous day. A value of 0d is valid, and is equivalent to 1d. See the following examples for more information.
If a period of hours, minutes or seconds is specified, an absolute time is calculated by subtracting the age from the current time, without regard to day boundaries. For example, if an age-specifier of 24h is given at 15:23:14, events are selected relative to 15:23:14 on the previous day.
A time-range-specifier consists of seven colon-separated fields in the following format:
Any component in the time range may be replaced by an asterisk (*) character as a wildcard, meaning that any value in this component will match the filter. You can specify multiple discrete values for a component by separating them with a comma. You can specify a range by using a hyphen to separate the starting and ending values for the range. An absolute-time-specifier is very similar to the time-range-specifier. It has only six components, and does not allow the use of wild cards. It has the following format:
In both forms of time specification, the range of values for each component is shown in the following table.
Any expression may be inverted (logically negated) by the use of the NOT operator, the exclamation mark (!) or the keyword NOT.
A complex filter is composed of two or more simple filters, combined using the AND (& or keyword AND) and OR (| or keyword OR) logical operators. Component filter expressions may be grouped in parentheses (( and )) to set the precedence of test operations. The order of precedence of logical and grouping operators (highest to lowest) is:
( ) ! & |
Event filters can be direct or indirect. A direct filter is a text string appearing at the point of filter specification. An indirect filter is contained in a file, and is referred to using the following syntax:
See evmfilterfile(4) for more information about using indirect filters.
If an event being evaluated does not contain the item being compared in a filter expression, the expression always yields no match. For example, if the timestamp item is missing from the event and you include the before keyword in a filter string, that part of the filter will return no match.
The following table shows a number of filter specifications, and the interpretation given to each.
EvmConnSubscribe(3), EvmFilterCreate(3), EvmFilterDestroy(3), EvmFilterIsFile(3), EvmFilterReadFile(3), EvmFilterSet(3), EvmFilterTest(3).