The response
to an event is any action determined by your site-specific needs
and conditions. This response can range from activating alarms or paging
responsible personnel, to making a log entry or ignoring an expected
occurrence of a regular activity.
You can configure the event processing sequence to perform
a series of dependent tasks, by using an event output by one task
as the trigger to activate the next process. Event Manager provides
an interface to the response activity through the logging facility.
The available options are event storage and event forwarding.
The
logger, evmlogger, started automatically by the Event Manager daemon, is
responsible for the following:
Displaying
selected events on the system console or other devices
If a terminal device is indicated as the logfile in
the configuration file, all events meeting the filter specifications
of an eventlog statement are formatted for display
on the terminal. For more information about the configuration file,
see “Configuring Event
Manager Logger”
Storing selected events in one or more log files
Forwarding selected events to interested parties
in some other form
By default, the logger handles events posted through its local
daemon. For more information, see “Event Manager Command Line Utilities”.
The
logger is an ordinary client that is controlled through a configuration file.
The default is the /etc/evmlogger.conf file, described in “Configuring Event
Manager Logger”. For more information on this file and command,
see evmlogger.conf(4) and evmlogger(1M) manpage.
Logging Events |
 |
All events meeting
the specifications of an eventlog group in the configuration
file are written to the event log. For the default location of this
file and the naming conventions, see “Event Manager System Files” .
You can include a suppress group
specification in an eventlog statement in the
configuration file. When you include such a statement, events meeting
the suppression criteria are not entered in the log. One instance
of the event is stored, with additional data indicating the number
of events and the time of the first and last occurrence of the event.
For the explanation of this criterion, see evmlogger.conf(4).
Using Forwarding to Handle Events Automatically |
|
If
you want to automate the handling of selected events, you can configure
the Event Manager logger to forward the event by executing a command.
For example, you can mail the event information to a paging service,
or invoke an event-handling application program.
By default, the logger is configured to mail high priority
events to the superuser. You can use the default forwarding command
as an example for developing your own actions. For more information,
see “Configuring Event
Manager Logger” and
the evmlogger.conf(4) manpage.
All events meeting the filter specifications of a forward statement
in the configuration file are written to the standard input (stdin)
of the command specified in the statement. The command is the name
of a shell script, a single UNIX command, a series of UNIX commands
(pipeline), or any other executable statement. The following operations
are typically specified as a forwarding action:
Specifying the mail command or mailx command, or another command-line mail processor, to send
an e-mail to a responsible person or paging service.
Invoking additional software that causes emergency
shutdown procedures to commence.
Invoking a dependent process that is waiting for
the event to occur
When configuring the logger to forward an event, consider
the following points:
The event selected
for forwarding is piped in to the forwarding command. If your commands
need to deal with text information, the evmshow command
must be the first command in the pipeline so that the event is converted
to text form.
The logger executes the forwarding command asynchronously.
It starts the command and then continues with its normal operation without
waiting for the command to finish. The following behaviors are normal:
If multiple forwarders are specified in the logger's
configuration file, and the same event is to be handled by more
than one forwarder, the logger starts each forwarding command without waiting
for the others to finish. As a result, the commands may execute
simultaneously.
If the logger receives another event to be processed
by a forwarding command, and the command is still processing the previous
event, the logger queues the new event. When the command completes,
the logger restarts it, passing it to the new event. By default,
the logger queues up to 100 events for each forwarding command.
You can increase this limit by specifying a MAXQUEUE keyword
in the forwarder's configuration.
For
more information, see evmlogger.conf(4) .
Event text can include characters such as quotes,
which have a special meaning to the shell. You must post test versions
of the event to verify that your command executes correctly under
realistic conditions.
You must ensure that the forwarding command does
not itself result in the posting of events which can cause an event
loop. For example, if you use e-mail to forward events, the forwarder's
filter must exclude mail events.
Use the logger's secondary configuration file facility for
adding forwarders or other configuration items. For more information,
see “Secondary Logger
Configuration Files”.
Printable version
