Linux Event Logging for Enterprise-Class Systems


evlgentmpls - generate formatting templates for event-logging calls


evlgentmpls directory object-file ...


For each object-file, evlgentmpls reads the .log section (if any) and generates a template specification for each event-logging call described therein.

All template specifications for the facility whose canonical name is facname are appended to directory/facname/facname.t. directory, directory/facname, and facname.t are all created if they do not already exist. Multiple object-files can yield template specifications for the same facility. Each facname.t file can be compiled using evltc.

A canonical facility name is created by converting uppercase ASCII letters to lowercase, spaces to underscores, and all other ASCII punctuation characters to periods.

object-file may be relocatable (.o), executable (a.out), or a library (.a or .so).

When you compile a C file containing calls to syslogat(), information about each call is recorded in the .log section of the resulting object file. This information includes the names of the source file and calling function , plus the syslogat() format string (which may specify attribute names for the values logged). You can then use evlgentmpls to create the template source file(s) corresponding to those calls, and evltc to compile the template source file(s). Once you have installed the resulting .to files (typically in /var/evlog/templates), evlview and other libevl-based programs can use those templates when examining events logged by your program.

evlgentmpls can also be applied to kernel object files -- for example, files that contain calls to the proposed printkat() macro.

To strip the .log section out of an object file after you have run evlgentmpls, use "objcopy -R .log objfile".


Suppose raidmon.c contains the following lines:

       #define EVL_FACILITY_NAME raidmon
            "Fan #{fan}%d has been shut down; {ngoodfans}%d fans remaining.0,
            badfan->id, ngoodfans);

When you compile raidmon.c, information about the syslogat() call is stored in the .log section of raidmon.o.
The command

       # evlgentmpls /var/evlog/templates raidmon.o

(run as root, so it can write to /var/evlog/templates) creates the directory /var/evlog/templates/raidmon and the template source file raidmon.t in that directory. raidnon.t contains a template specification for each syslogat() call in raidmon.o.
The command

       # evltc /var/evlog/templates/raidmon/raidmon.t

compiles raidmon.t and generates a binary template (.to file) for each syslogat() call.
With these templates in place, a command such as

       $ evlview -b -f 'ngoodfans < 3'

can be used to find records such as the one logged by the aforementioned syslogat() call.