是否有工具可過濾 critical system event?

[watermelonyu]

HP Tru64 5.1A 是否有工具類似 HP-UX 的 Event Monitoring Service(EMS), 可透過設定, 將 H/W 的錯誤訊息即時以 mail 通知系統管理員?

[watermelonyu]

Hello Eric:



Tru64 UNIX 也有類似的系統-EVM. 它的內定設定是將事件送給root, 所以您可定期讀取root mail,或將它forward給相關系統管理者,事件有包括network, file system, security,H/W等等.



Best Regards

Danny Lin

[watermelonyu]

Hi, Danny:



Thanks for your reply. 可否詳細說明該如何設定 EVM.

[watermelonyu]

Hi all,



The evmd (Event Manager Daemon)is default run on Tru64 UNIX V5.X. And

it should be sent a critical event (if the priority is equal or greater to 600) to root via the statement

command "evmshow -d -t 'Subject: EVM ALERT : @@' | mail root"

that shown from /etc/evmlogger.conf as below:



Of course you could change them if necessary, but don't forget to restart

it from "evmstop" and "evmstart".



# more /etc/evmlogger.conf

.

# Forward details of high-priority events to root:

forward {

name priority_alert



# Don't forward mail events through mail (see note above).

filter " & !"



suppress

{ filter ""

period 120 # minutes

threshold 1 # No. of duplicates before suppression

}



# This evmshow command writes a subject line as the first line of

# output, followed by a detailed display of the contents of the event.

# The resulting message is distributed by mail(1).

command "evmshow -d -t 'Subject: EVM ALERT : @@' | mail root"



# Limit the number of events that can be queued for this command:

maxqueue 100

}



Best regards,

Richard.

[watermelonyu]

可否舉例說明, 如何修改 /etc/evmlogger.conf, 使得發 mail 的對象, 除了原來的 root 之外, 如何同時 cc mail to sa@hp.com (假設原 server 已做好可send mail to sa@hp.com 的設定)?



Thanks



Eric

[watermelonyu]

Hi Eric,



Please change the following statement:

command "evmshow -d -t 'Subject: EVM ALERT : @@' | mail root"

TO

command "evmshow -d -t 'Subject: EVM ALERT : @@' | mail root sa@hp.com"



Then run "evmreload -l" to reconfigure the evmlogger daemon.



PS: Please see the online manu "man evmlogger.conf".



For your reference:

Customizing the evmlogger

The logger can easily be customized to either generate additional logfiles or

additional forwarders.



For example, to generate an ASCII log file that records hardware component

events (@SYS_VP@.hw.*) with a priority of 400 or more recording the event

name, priority, timestamp and event description add an entry into

/etc/evmlogger.conf such as the following and then run evmreload –l to

reconfigure the evmlogger daemon



eventlog {

name hardware_events

logfile /var/hwevents

filter " & "

type formatted

show_template "@name @timestamp @@"

}



Similarly to ensure that user Student on machine unix.hp.com is mailed

whenever a SCSI event is generated by the binary errorlog subsystem customize

the /etc/evmlogger.conf file as follows and again run evmreload –l to

reconfigure the evmlogger daemon.



forward {

name scsi_alert

filter ""

command "evmshow -d -t 'Subject: EVM ALERT : @@' | mail Student@unix.hp.com"

}



Regards,

Richard.