Welcome to Linux Knowledge Base and Tutorial
"The place where you learn linux"
Traveller''s Lunchbox

 Create an AccountHome | Submit News | Your Account  

Tutorial Menu
Linux Tutorial Home
Table of Contents

· Introduction to Operating Systems
· Linux Basics
· Working with the System
· Shells and Utilities
· Editing Files
· Basic Administration
· The Operating System
· The X Windowing System
· The Computer Itself
· Networking
· System Monitoring
· Solving Problems
· Security
· Installing and Upgrading
· Linux and Windows

Man Pages
Linux Topics
Test Your Knowledge

Site Menu
Site Map
Copyright Info
Terms of Use
Privacy Info
Masthead / Impressum
Your Account

Private Messages

News Archive
Submit News
User Articles
Web Links


The Web

Who's Online
There are currently, 63 guest(s) and 0 member(s) that are online.

You are an Anonymous user. You can register for free by clicking here




       evlview --help


       evlview [ input] [ output ] [ -f | --filter filter ]
        [ -b |  --templates ] [ -B | --notemplates ]

       input    (defaults    to    /var/evlog/eventlog,   or   to
       /var/evlog/privatelog with -p | --private):
        [ -n | --new ][ -T | --timeout nsec ][ -R | --recid rid ]
        [ -l | --log srclogfile] [ -t | --tail nrec ]
        [ -r | --reverse ]

       output (defaults to stdout):
        [ -o | --out destlogfile ]
        [ -S | --formatstr format-string ] [ format_opts ]
        [ -F | --formatfile format-file ] [ format_opts ]
        [  -c  |  --compact  ]  [  -s  | --separator sep ] [ -q |
       --nmeqval ] [format_opts]
        [ -m | --syslog ]

        [ -N | --newlines n ] [ -d | --datefmt date-format ]


       The evlview utility lets you view  events  from  an  event
       log,  view  events  in  real time, or read records from an
       event log and write the records to another file.


       -n, --new
              Display only new events  as  they  are  logged.  By
              default,  events are read from the entire event log
              until the end of the log is reached. This option is
              not  valid  when  --log  specifies  an inactive log

       -T, --timeout nsec
              Specifies the interval in seconds that  the  viewer
              should  wait for the next event to be generated. If
              this interval passes with no new events, the viewer
              terminates.  The  interval  restarts  with each new
              event. By  default,  with  the  --new  option,  the
              viewer  runs  until  it  is  killed. This option is
              specified, events are read from the  active  system
              log, /var/evlog/eventlog.

       -p, --private
              Equivalent to --log /var/evlog/privatelog.

       -t, --tail nrec
              Specifies  that  evlview  should read the last nrec
              records in the event log file. If a filter is spec­
              ified,  then  the  last  nrec records are read that
              match the filter.

       -r, --reverse
              Read events in reverse  order,  starting  with  the
              most  recently  written  event.  Default is to read
              starting with the oldest event in the event log.

       -o, --out destlogfile
              Specifies that event records should be appended  to
              the  specified  destlogfile  instead  of being dis­
              played to stdout. This option is not valid with the
              --formatstr,  --formatfile, --compact, --separator,
              --datefmt,  --newlines,   --neqval,   or   --syslog

       -S, --formatstr format-string
              Specifies an alternative format for events that are
              displayed (see Example 3).

              For the fixed portion of the event record,  members
              are  referenced  by  the attribute names defined in
              the   POSIX   standard:   recid,   size,    format,
              event_type,  facility,  severity,  uid,  gid, pgrp,
              time, flags, thread, and processor.

              An additional attribute is available,  host,  which
              displays  the  name  of  the  host  that logged the

              For log_format of STRING, %data% displays the vari­
              able-length data as the data string.

              For  log_format  of  NODATA, %data% displays a NULL

              For log_format of BINARY, %data% displays the vari­
              able  length  data according to the associated for­
              matting template, if any, or  in  hex  dump  format

              If  log_format  is BINARY and a formatting template
              exists for the event record, optional attributes in
              option is not valid if specified along with  --out,
              --formatstr,  --compact,  --separator, --neqval, or

       -c, --compact
              Specifies that contents of  the  event  record  are
              displayed  in  a compact form. In compact form, the
              attribute names for attributes in the fixed portion
              of  the  event  record  are not displayed, only the
              values.  This option cannot be used with  --format­
              str, --formatfile, --syslog, or --out.

       -s, --separator sep
              Specifies  that the character string sep be used as
              the separator between attributes displayed  by  the
              viewer.  The default separator is ",".  The separa­
              tor  string  cannot  exceed  20  characters.   This
              option is not valid with --formatstr, --formatfile,
              --syslog, or --out.

       -N, --newlines n
              When displaying records,  ensures  that  there  are
              exactly  n  newlines between records.  For example,
              -N 2 gets you exactly 1 blank line between records.
              n  must  be greater than zero.  If a record ends in
              more than n newlines, then an appropriate number of
              those  newlines  will  be omitted from the display.
              If this option is  omitted,  evlview  ensures  that
              there  is  at  least  one  newline between records.
              This option is not valid with --out or --syslog.

       -d, --datefmt dateformat
              Format the  log_time  attribute  according  to  the
              dateformat  string,  which  is  passed to the strf­
              time(3) function.   The  default  format  is  "%c".
              This option is not valid with --out or --syslog.

       -m, --syslog
              Approximate  the  output  format  of the syslogd(8)
              daemon: for each record displayed, print the times­
              tamp,  host name, and message.  For multi-line mes­
              sages, BINARY-format events, and  events  formatted
              by  formatting  templates,  the output may not look
              much like syslogd output.  This option is not valid
              with  the --out, --formatstr, --formatfile, --nmeq­
              val, --compact, --separator, --datefmt,  or  --new­
              lines options.

       -q, --nmeqval
              For records that have associated templates, display
              the non-standard attributes in  name=value  format,
              one  attribute  per line.  This option is not valid
              template rather than in the fixed  portion  of  the
              event record.  For a particular event, if the named
              attribute does not exist, it will format as a  null
              string,  and references to it in the filter expres­
              sion will evaluate to false.

       -B, --notemplates
              Specifies  that  the  evlview  command  should  not
              attempt   to   locate   formatting  templates.   By
              default, evlview will  attempt  to  use  formatting
              templates when displaying records.

       -h, --help
              Displays the usage statement.


       Example 1.
              evlview --filter 'facility==USER && data contains
                 "interface reset"'

              might  produce the following output (if there are 2
              matching events in the log):

              recid=7214, size=31, format=STRING, event_type=0x3, facility=USER,
              severity=ERR, uid=bill, gid=appdev, pid=2753, pgrp=44,
              time=Mon Jun 18 19:32:31 2001, flags=0x0, thread=0x0, processor=1,
              Eth/0 interface reset by user

              recid=8612, size=31, format=STRING, event_type=0x3, facility=USER,
              severity=ERR, uid=bill, gid=appdev, pid=2753, pgrp=44,
              time=Wed Jun 20 14:32:31 2001, flags=0x0, thread=0x0, processor=1,
              Eth/1 interface reset by user

              Note that the date and time  format  shown  in  the
              examples  is based on the LANG environment variable
              not being set (or being set  to  "C").   For  other
              settings, the format will differ.  For example:

                   $export LANG=es_MX    (Spanish, Mexico)

              might result in a display of:

                   lun 04 feb 2002 11:52:18 PST

              Also, see Example 6 for additional date formatting options.

       Example 2.
              evlview -f 'facility==LOCAL1 && data contains
              "Eth/0 interface"' --compact -s !
              Logical unit number is 0x3
              for facility LOCAL1 and event type of 12565 decimal, 0x3115 hex

              Note  that  the  -b  option allows the non-standard
              attribute "lun" to be included with the -f  (--fil­
              ter) option.

              Also, note that due to the length of the formatting
              string, use of the  --formatfile  option  would  be
              preferable in practice instead of the -S or format­
              str option.

       Example 4.
              evlview -f 'age < "2h"'

              would display all events logged during the  past  2

       Example 5.
              lastrid=`cat /var/evlog/bootrecid`
              nextrid=`expr $lastrid + 1`
              evlview -n -R $nextrid -f 'flags & printk'
                 --syslog >> /var/log/printks

              would     run     continuously,     appending    to
              /var/log/printks all messages logged  by  the  ker­
              nel's  printk()  function,  starting with the first
              message after the current boot.  The message format
              is that of the syslogd daemon.

       Example 6.
              evlview -b -S "%time% %host% %facility% %severity%
                 %event_type%"  --datefmt "%A %B %d %l:%M:%S %p"

              might display the following:

                 Tuesday June 04  1:29:26 PM elm3b99 KERN NOTICE 0x2ffe11ac
                 Tuesday June 04  1:29:26 PM elm3b99 KERN ALERT 0x5818f89e
                 Tuesday June 04  1:29:26 PM elm3b99 LOGMGMT INFO 0x28

              and demonstrates the use of the --datefmt option.


              Standard Event log

              Private log

       nates with an error message.

                         6 December 2002               EVLVIEW(1)

An undefined database error occurred. SELECT distinct pages.pagepath,pages.pageid FROM pages, page2command WHERE pages.pageid = page2command.pageid AND commandid =


Looking for a "printer friendly" version?



Security Code
Security Code
Type Security Code

Don't have an account yet? You can create one. As a registered user you have some advantages like theme manager, comments configuration and post comments with your name.

Help if you can!

Amazon Wish List

Did You Know?
You can help in many different ways.


Tell a Friend About Us

Bookmark and Share

Web site powered by PHP-Nuke

Is this information useful? At the very least you can help by spreading the word to your favorite newsgroups, mailing lists and forums.
All logos and trademarks in this site are property of their respective owner. The comments are property of their posters. Articles are the property of their respective owners. Unless otherwise stated in the body of the article, article content (C) 1994-2013 by James Mohr. All rights reserved. The stylized page/paper, as well as the terms "The Linux Tutorial", "The Linux Server Tutorial", "The Linux Knowledge Base and Tutorial" and "The place where you learn Linux" are service marks of James Mohr. All rights reserved.
The Linux Knowledge Base and Tutorial may contain links to sites on the Internet, which are owned and operated by third parties. The Linux Tutorial is not responsible for the content of any such third-party site. By viewing/utilizing this web site, you have agreed to our disclaimer, terms of use and privacy policy. Use of automated download software ("harvesters") such as wget, httrack, etc. causes the site to quickly exceed its bandwidth limitation and are therefore expressly prohibited. For more details on this, take a look here

PHP-Nuke Copyright © 2004 by Francisco Burzi. This is free software, and you may redistribute it under the GPL. PHP-Nuke comes with absolutely no warranty, for details, see the license.
Page Generation: 0.08 Seconds