Using EELS

Using standard reports

EELS supports a number of standard report formats that you can use with eels_log_report(1Meels). These report formats are stored in a configuration file called report.rc. Use the following command to list the reports contained in this file:

eels_log_report -l R

A report similar to the one shown below is displayed:

   Reports defined in report.rc
   
   Report                    Specifications
   

   audit                     Audit_Report
          column_filter      LSS(= "audit")
          column_widths      UEID(12) TO(30) ENS(10) ESI(32)
         fields_to_list      UEID(Uniq ID) TO(Date-Time) ENS(Event) ESI(Event)
            page_height      65
                  title      Activity Report
   

   syslog                    Syslog_Report
          column_filter      LSS(= "syslog")
          column_widths      UEID(12) TO(30) OSN(12) ESI(32)
         fields_to_list      UEID(Uniq ID) TO(Date-Time) OSN(Origin) ESI(Event)
            page_height      65
                  title      Syslog Report
   

   xdas                      XDAS_Report
          column_filter      LSS(= "xdas")
          column_widths      UEID(12) TO(30) ESI(32)
         fields_to_list      UEID(Uniq ID) TO(Date-Time) ESI(Event)
            page_height      65
                  title      XDAS Activity Report

Use the report names on the left of the report in conjunction with eels_log_report to generate standard reports. For example, to generate a standard report for syslog messages from the default EELS database, use the following command:

eels_log_report -r syslog

You can also use the date matching mechanism supplied by eels_log_report. This mechanism supports the following date formats:

yyyy-mm-dd hh:mm:ss-zz
mm/dd/yyyy hh:mm:ss zzz
dd.mm.yyyy hh:mm:ss zzz
dd/Mon/yyyy.hh:mm:ss
dd/Mon/yyyy
mm/dd/yy
yy/mm/dd hh:mm:ss
ddd/mm/dd hh:mm:ss yyyy
TODAY
YESTERDAY
TOMORROW
TODAY hh:mm:ss
YESTERDAY hh:mm:ss
TOMORROW hh:mm:ss
hh:mm:ss
hh:mm

For example, to report all syslog messages between the 5th August 1998 and the 10th August 1998, you could use the -b and -e options of eels_log_report in the following way:

eels_log_report -r syslog -b '08/05/1998' -e '08/10/1998'|lp

If the report still contains too much information, you could restrict the amount of data returned by using the -w option that enables you to specify a WHERE clause. For example, you may want to specify a WHERE clause that selected only records where the UniqEventID was greater than 800:

eels_log_report -r syslog -b '08/05/1998' -e '08/10/1998' \
where 'UEID > 800'|lp