E.3.5 Modifying Commands
By default, the analysis, translation, summary and new binary log file commands all process the system event log. The output from analysis, translation and summary commands is displayed on the screen. You can change these defaults in order to process other binary log files and save the processing results to a file. With some of the commands you can further restrict the events that are processed by filtering the binary log file used for input. The following sections describe how to use these features.
E.3.5.1 Input Files
To change the binary log file used as input by a command, append the directory and file name of the desired file to the end of the command. For example:
wsea x analyze examples\memory_channel_adapter.errlogWhen you are specifying an input file, the following guidelines apply:
- Specifying an input file is optional. If you do not specify either a directory or a file, SEA processes the binary system event log.
- The old common syntax filterlog command is the exception to this rule and requires an input file. See Section E.3.4 for more information.
- You can use the relative directory structure to specify input files.
- If you specify a directory but no file name, SEA processes all the files with a .errlog, .sys, .zpd, or .evt extension located in the provided directory.
- Multiple filenames can be specified by separating them with spaces.
- You can use wildcards to specify multiple files.
E.3.5.2 Output Files
These output file guidelines do not apply when you are creating a new binary event log. See Section E.3.4 for more details.
To specify an output file, use one of the following modifiers:
outtext filename outhtml filename
- The outtext modifier creates a text output file and the outhtml modifier creates a HTML output file. The filename indicates the path and name where you want to save the output.
The following examples show commands that specify output files:
wsea x analyze outtext results.txt wsea x analyze outhtml results.htmlE.3.5.3 Filtering
The trans and filterlog commands enable you to filter a binary event log file and only process a subset of the events. The general rules that apply to filtering in the old common syntax are:
- Use the filter keyword before the filter statement when filtering with the trans command.
- Filter statements must be enclosed in quotation marks.
- You can join multiple filter statements by using an ampersand (&) between them.
Table E–3 describes the old common syntax filtering statements.
Table E–3 Filtering Statements (Old Common Syntax) Filter Statement Description dtb=date(date_time_begin)dte=date(date_time_end) Filters based on the time the event occurred. No events that occurred before the given start time or after the given end time are processed. The date can be entered in any format supported by Java (for example, dd-mmm-yyyy,hh:mm:ss). You do not need to include the time (hh:mm:ss) with the date. rtdb=days(rel_time_days_begin)rtde=days(rel_time_days_end)rthb=hours(rel_time_hours_begin)rthe=hours(rel_time_hours_end) Filters based on the time the event occurred relative to the time the first or last event in the log file occurred. Filtering based on days and hours is supported. For example, using the filter rtdb=3 will processes all the events that occurred within three days of the first event in the file. et=nnet!=nnet<nnet>nn(entry_type) Filters based on the numeric event type. Be aware of the following guidelines:With the = and != operators you can enter multiple entry types by separating them with commas. Instead of entering entry type numbers, you can use one of the supported keywords. See Table E–4 for the supported keywords. cn=namecn!=name(computer_name) Filters based on the node responsible for generating the event.Using the = and != operators you can enter multiple entry types by separating them with commas. The name argument is case sensitive. ost=nost!=n(os_type) Filters based on the operating system type, using the numeric representation for each operating system. With the = and != operators you can enter multiple entry types by separating them with commas. idx=nnidx!=nnidx<nnidx>nn(event_index) Filters based on the event's position in the event log. The first event in the file is event index 1. With the = and != operators you can enter multiple entry types by separating them with commas. sort=keyword Used with a keyword to organize the output. The following keywords are supported:entry—sorts based on entry type from highest entry type number to lowest reventry—sorts based on entry type from lowest entry type number to highest time—sorts based on entry time from most recent to oldest revtime—sorts based on entry time from oldest to most recent idx—sorts based on the entry index number from highest to lowest revidx—sorts based on the entry index number from lowest to highest The following examples show sample commands that use filtering.
Processes events from the system described by ComputerName:
wsea x trans filter "computer_name=ComputerName" wsea x filterlog inputfile.zpd outputfile.bin "computer_name=ComputerName"Processes events that did not occur on the system described by ComputerName that occurred after January 11, 2000:
wsea x trans filter "computer_name!=ComputerName & date_time_begin=11-Jan-2000" wsea x filterlog inputfile.zpd outputfile.bin "computer_name!=ComputerName & date_time_begin=11-Jan-2000"Processes events that occurred before 8:33:57 PM on January 31, 2000:
wsea x trans filter "date_time_end=31-Jan-2000,20:33:57" wsea x filterlog inputfile.zpd outputfile.bin "date_time_end=31-Jan-2000,20:33:57"Processes events that occurred no more than four days after the first event in the log file:
wsea x trans filter "rel_time_days_begin=4" wsea x filterlog inputfile.zpd outputfile.bin "rel_time_days_begin=4"Processes events that occurred no more than 35 hours before the last event in the log file:
wsea x trans filter "rel_time_hours_end=35" wsea x filterlog inputfile.zpd outputfile.bin "rel_time_hours_end=35"Processes all CPU machine check events:
wsea x trans filter "entry_type=mchk-cpu" wsea x filterlog inputfile.zpd outputfile.bin "entry_type=mchk-cpu"Processes all events, except those of type 610, 620, and 630. Only the common syntax supports filtering based on specific entry types the other syntaxes must use keywords:
wsea x trans filter "entry_type!=610,620,630" wsea x filterlog inputfile.zpd outputfile.bin "entry_type!=610,620,630"Processes all events with a type greater than 600:
wsea x trans filter "entry_type>600" wsea x filterlog inputfile.zpd outputfile.bin "entry_type>600"Processes all events with a type less than 300 and an operating system of type 3:
wsea x trans filter "entry_type<300 & os_type=3" wsea x filterlog inputfile.zpd outputfile.bin "entry_type<300 & os_type=3"Processes all events without an operating system type of 1 or 2. The translation command presents the output in reverse chronological order:
wsea x trans filter "os_type!=1,2 & sort=revtime" wsea x filterlog inputfile.zpd outputfile.bin "os_type!=1,2"Processes all the events after the fifteenth event in the log file:
wsea x trans filter "event_index>15" wsea x filterlog inputfile.zpd outputfile.bin "event_index>15"