EMS Manual

EMS Components and Architecture
EMS Manual—426909-005
2-8
Subsystem Support
Subsystem Support
Subsystems and user-written applications send event information to the primary and
alternate collectors by means of the WRITEREAD procedure call. Event messages are
based on tokens rather than text.
Pre-Log Filtration (PLF)
Pre-log filtration lets primary and alternate collectors use EMS filters to determine
whether specific events should be logged to the EMS log files. Judicious use of PLF
conserves disk space and system resources that might otherwise be required to write
unnecessary or redundant events to the EMS logs.
PLF is implemented by adding one or more filters to a collector:

Compiled filters and filter tables can fail one or more particular events, thereby
preventing the failed events from being forwarded to the collector’s log files.

Burst filters can suppress event bursts based on burst size, duration, and other
criteria (rather than the event type). Burst filters use the EMS burst detection and
suppression (BDS) feature. For details, see Section 7, Burst Detection and
Suppression.
Log-File Management
The collector writes messages to log files. The collector either writes messages one at
a time or writes a number of messages to a buffer then writes that entire message
group to the log file. The process of writing a group of messages to a buffer is known
as blocking. Blocking significantly increases the speed at which messages are written
to the log file.
Tasks associated with log switches (switching to using a new log file when the current
file becomes full) are performed when the collector is idle; that is, when there are no
events to log. The tasks include purging and deallocating (disk space) the old log file
and preallocating (disk space for) the next log file.
Each collector maintains its own log files according to parameters you specify. These
parameters can vary for each collector, and they control these log file variables:

Disk volume and subvolume in which the log files are to be created

Number of log files that can exist concurrently in one subvolume

Primary-extent and secondary-extent sizes for each file

Whether or not event messages are blocked before they are written to the log file

Whether or not the file label is updated on disk each time the end of file is
advanced

Security attributes of the log files the collector creates