3.9 Modifying Commands
By default, the analysis, translation, summary and new binary log file commands all process the system event log. The output from analysis, translation and summary commands is displayed on the screen. You can change these defaults in order to process other binary log files and save the processing results to a file. When you are performing translation, generating a summary, performing analysis, or creating a new binary log file you can further restrict the events that are processed by filtering the binary log file used for input. The following sections describe how to use these features.
3.9.1 Input Files
Many of the commands used in manual mode enable you to specify an input binary event log file. To specify an input file using the new common syntax, append the following modifier to the command:
input filename
- Where filename indicates the path and name of the input file.
When you are specifying an input file, the following guidelines apply:
- Specifying an input file is optional. If you do not specify either a directory or a file, SEA processes the binary system event log. An example of a command without any input file criteria is shown here:
wsea ana
- You can use the relative directory structure to specify input files. Thus, if you were in the C:\Program Files\hp\svctools\common\ca directory and you wanted to analyze the ds20.errlog binary event log located in the C:\Program Files\hp\svctools\common\ca\examples directory, you could enter the following command:
wsea ana input examples\ds20.errlog
- If you specify a directory but no file name, SEA processes all the files with a .errlog, .sys, .zpd, or .evt extension located in the provided directory. An example of a command that only indicates a directory is shown here:
wsea analyze input examples
- Multiple filenames can be specified by separating them with a comma and space, as shown in the following example:
wsea ana input examples\ds20.errlog, examples\hscir1.zpd
- You can use wildcards to specify multiple files. In the example shown here, all the files located in the examples directory with a name that starts with ds and an .errlog extension are analyzed:
wsea ana input examples\ds*.errlog3.9.2 Output Files
With many commands, you can save the results of processing to a file rather than viewing the output on the screen.
These output file guidelines do not apply when you are creating a new binary event log. Refer to Section 3.8 for more details.
To send the output of an operation to a file, use one of the following modifiers:
out filename outhtml filenameThe out modifier creates a text output file and the outhtml modifier creates a HTML output file. The filename indicates the path and name where you want to save the output.
The following examples show commands that specify output files:
wsea ana out results.txt wsea ana outhtml results.html3.9.3 Filtering
The tra, sum, bin, and ana commands enable you to filter a binary event log file and only process a subset of the events. The following general rules apply when you use filters:
- You can include multiple filter statements by separating them with comma and a space.
- You can abbreviate the filter parameters. You only need to enter the minimum number of letters required to uniquely identify a parameter. For example, index could be abbreviated as ind.
- On Windows systems, any argument that includes a comma must be enclosed in quotation marks. This includes arguments that contain a date.
Table 3–5 describes the filtering statements available with the new common syntax.
Table 3–5 Filtering Statements (New Common Syntax) Filter Statement Description begin="date"since="date"end="date" Filters based on the time the event occurred. No events that occurred before the given start time or after the given end time are processed. The date can be entered in any format supported by Java (for example, dd-mmm-yyyy,hh:mm:ss). You do not need to include the time (hh:mm:ss) with the date. Be aware of the following guidelines:The begin and since statements are equivalent. You can use the keywords YESTERDAY and TODAY. With the begin and since keywords, you can enter a negative integer value to process based on a relative date. For example, entering -3 processes events from the last three days. include=keywordexclude=keyword Filters based on the numeric entry type. You must enter a keyword rather than the actual entry type. Refer to Table 3–6 for information on supported keywords. node=name Filters based on the node responsible for generating the event. The name argument is case sensitive. index=nnindex="start:nn, end:nn" Filters based on the event's position in the event log. The first event in the file is event index 1. reverse Processes the events in reverse order according to the event index number.The following examples show sample commands that use filtering.
Processes events from the system described by ComputerName:
wsea tra node=ComputerName wsea sum node=ComputerName wsea bin input inputfile.zpd out outputfile.bin node=ComputerNameProcesses events that occurred before 8:33:57 PM on January 31, 2000:
wsea tra end="31-Jan-2000,20:33:57" wsea sum end="31-Jan-2000,20:33:57" wsea bin input inputfile.zpd out outputfile.bin end="31-Jan-2000,20:33:57"Processes all CPU machine check and system machine check events. The translation command presents the output in reverse chronological order:
wsea tra include="mchk_cpu, mchk_sys reverse" wsea sum include="mchk_cpu, mchk_sys" wsea bin input inputfile.zpd out outputfile.bin include="mchk_cpu, mchk_sys"Processes all the events after the fifteenth event in the log file:
wsea tra index=start:15 wsea sum index=start:15 wsea bin input inputfile.zpd out outputfile.bin index=start:15