sysevent(1)
sysevent - System Log Event Capture System Daemon
As shipped in IRIX 6.5.15. Added in IRIX 6.5.15.
NAME sysevent - System Log Event Capture System Daemon SYNOPSIS sysevent [-n1T] [ -f|-F syslog_pipe ] [ -c config_file ] [ -r|-R reject_file ] [ -t #threads ] [ -E regex_options] [ -a default_exec] [ -A default_dso] [ -p #procs ] syseventFilter sysevent -h DESCRIPTION sysevent capture messages generated from syslogd(1m) and, using regex(3g) pattern stored in a configuration file, allow one or more user-defined action to be performed when a message match a given expression. sysevent is multi-threaded. Someone may also want to use the -T mode to remove duplicates from the configuration file: the new configuration file will go on standard output. sysevent capture syslogd-generated messages using syslog pipe file mechanism. By default, /tmp/.sysevent is used and /etc/syslog.conf need the following entry: *.debug @|/tmp/.sysevent SPECIAL CASE: If the second form is used ( syseventFilter ) or -1 command-line argument is used, sysevent will read one(1) line of data. Using that form implies -t 1 and -n. This is is intended to be used in /etc/syslog.conf like this: *.debug |/usr/sbin/syseventFilter /var/adm/SYSLOG NOTE: For this special case only, if the configuration file /etc/sysevent.config is missing, sysevent will silently exit and not report any error message to syslogd. PARAMETERS Description -d debug mode ( Imply -n ) . In debug mode, action are sent in foreground. -n no fork -T test mode. If set. the config_file is checked against duplicates -1 Run once. sysevent will read one(1) line of data. Using that form implies -t 1 and -n. This is is intended to be used in /etc/syslog.conf like this: *.debug |/usr/sbin/syseventFilter /var/adm/SYSLOG -f syslog pipe specified in /etc/syslog.conf -f : named pipe ; -F : Unix Socket. Default: a named /tmp/.sysevent -c sysevent configuration file with up to 32768 entries. Default:/etc/sysevent.config -r Collect unknown event to reject file. -r : overwrite. -R: append mode Default is : off -t # threads for regex analysis.Default:8 -E regcomp(3) compilation flag. Default:0xb(REG_EXTENDED|REG_ICASE|REG_NOSUB) -a default action exec file. Default:/usr/local/bin/sysaction -A default action dso file. Default:/usr/lib/libsysevent.so Note: SIGHUP : re-read configuration file CONFIGURATION FILE SYNTAX ( /etc/sysevent.config ) The configuration is read upon sysevent startup and re-read entirely when it is modified. For sanity purposes, most parametres are verified and, if in error, will prevent sysevent to start properly,. However, if sysevent is already started and some modifications to the configurations files are done, depending on the nature of the error, sysvent may exit or not. In that case, an error will be recorded using syslogd(1m) facility LOCAL0. Also, sending a SIGHUP will also tell sysevent to re-read the configuration file. Up to a maximum of 32768 entries ( one per line ) can be entered in the configuration file. Lines starting with a '#' are comments. Syntax is: appname module action priority expression where: appname is the applcation generating the message module is an additional information along with appname action see ACTION DESCRIPTION priority is a string representing the priority. If prefixed with KERN_, KERN_ is stripped. expression is the regex(3g) expression. It is STRONGLY recommended , for speed purposes, to anchor with a ^ at the beginning of string. Likely, it is also recommended to end with a '$' at the end of the string. Please enclose everything with double-quotes. ACTION DESCRIPTION Actions can be an internal one when you specify an integer ( 0x format accepted ) or a script or a function from within a dso. For a dso, the library is opened and closed at each invocation: this allow someone to change/test a dso function without actually re-starting sysevent. The number format is for the sole purpose of ESP implementation. Each time an action is performed, sysevent fork and perform the action in background unless you are using debug mode ( with -d switch). Also, it sets the following environment variables: FROMHOST syslogd hostname generating the message PRIORITY If syslogd is running with "-S", priority of the logged message. Else, priority of the expression as read from sysevent config file. PRIORITYCF priority as read from sysevent config file LINECF sysevent config file line number APPNAME application generating the message MODULE module generating the message ACTION the entire action string WHEN date in ctime(3) format MESSAGE the actual message NOTE: arguments is anything after the 1st comma in sysevent config file. User is responsible to parse it in this script. For example, if they are comma-seperated, you can: set -- `echo $* | tr -s ',' ' '` The action syntax is: integer will internally call "/usr/sbin/esplogger -s $ACTION -m $MESSAGE" [executable],[,argument] will execute "executable" with optional "argument" ( after the 1st comma ). If 'executable' is empty, the -a default script will be used. [dso]:function[,argument] will execute "dso" function with optional "argument" ( after 1st comma ). The argument is passed as a string. If 'dso' is empty, the -A default dso will be used. It is illegal to use an empty function. NOTE: executable or dso MUST be full pathname, ie. start with a '/'. FILES /etc/syslog.conf some modifications /etc/sysevent.config configuration file /usr/local/bin/sysaction default action script /usr/lib/libsysevent.so DSO containing user-function callable actions NOTES o The configuration file can be automatically generated using syseventIrix(1m). This program reads /usr/lib/sysmon/notifier.config file and attempt to buid /etc/sysevent.config file. o Since the configuration file is mapped in memory using mmap(2) call, using an NFS-mounted configuration file may cause problems due to the stateless nature of NFS. SEE ALSO syslogd(1m), syseventIrix(1m) syseventEp(1m) AUTHORS/COLLABORATORS Michel Bourget: michel@sgi.com ESP(Embedded Support Partner) Project Electronic Services/Global Customer Service SGI