Log Filters and the logdump Command

Screen log filtering employs a common mechanism and language, regardless of the context in which it is used. This mechanism and language is embodied in the logdump command. The logdump command is based on, and is a superset of, the snoop program, which is provided with the standard Solaris operating environment.

logdump can be used on an Administration Station to filter and inspect logs during active retrieval or on logs previously retrieved and stored. In conjunction with the logmacro facility, predefined filters can be employed to simplify and regularize routine log processing tasks.

The general usage for logdump is as a subcommand of ssadm. ssadm provides character-set translation between strings embedded in log events and the local character set of the Solaris system on which it runs.

Although logdump is used directly as an ssadm subcommand, all other places in SunScreen where log filtering is allowed employ the same filter specification language. The examples in this section are prototypical of these other usage contexts.

Nominally, logdump input is either a log record stream directly from a possibly remote Screen, or captured log records from a file. This source of input is specified by the -i option.

Examples: logdump Command

To process (piped-in) records from the standard input:

admin% ssadm -r Screen log get | ssadm logdump -i- [output args] [filter args]

To process local file log record input:

admin% ssadm logdump -i local_log_file[output args] [filter args]

logdump fundamentally outputs either a stream of log records or readable text in various formats (after applying specified filters).

The presence of the -o option causes (binary) log records to be produced:

admin%ssadm logdump -i input arg -o local_log_file [filter args] 

Omit the -o option to output readable text.

The formatting options for readable text are common to snoop; these are -v, -V, -t[r|a|d], and -xoffset[,length]. For more information, see snoop(1M) man page.