Event log messages

Event log message format

For each event, a message is written to the backup log file in the following format:

type timestamp identifier event (event_info)

Example:

dmp Thu Apr 5 18:54:56 PDT /vol/vol0/home(5) Start (level 
0, NDMP)

Type field

Each log message begins with one of the type indicators described in the following table.

Type	Meaning
log	Logging event
dmp	Dump event
rst	Restore event

Timestamp field

The timestamp field shows the date and time of the event.

Identifier field

The identifier field for a dump event includes the dump path and the unique ID for the dump. The identifier field for a restore event uses only the restore destination path name as a unique identifier. Logging-related event messages do not include an identifier field.

Start and stop logging events

The event field of a message that begins with log contains one of the events shown in the following table.

Event	Meaning
Start_Logging	Indicates the beginning of logging or that logging has been turned back on after being disabled.
Stop_Logging	Indicates that logging has been turned off.

Dump events

The event field for a dump event contains an event type followed by event-specific information in parentheses. The following table describes the events, their meanings, and the related event information that might be recorded for a dump operation.

Event	Meaning	Event Information
Start	A dump or NDMP dump begins.	Dump level and the type of dump
Restart	A dump restarts.	Dump level
End	Dumps completed successfully.	Amount of data processed
Abort	The operation aborts.	Amount of data processed
Options	Specified options are listed.	All options and their associated values, including NDMP options
Tape_open	The tape is open for read/write.	The new tape device name
Tape_close	The tape is closed for read/write.	The tape device name
Phase-change	Dump is entering a new processing phase.	The new phase name
Error	Dump encounters an unexpected event.	Error message
Snapshot	A snapshot is created or located.	The name and time of the snapshot
Base_dump	A base dump entry in the etc/dumpdates files has been located.	The level and time of the base dump (for incremental dumps only)

Example for dump

The following is an example of the output for a dump operation:

dmp Thu Sep 20 01:11:22 GMT /vol/vol0/(1) Start (Level 0)

dmp Thu Sep 20 01:11:22 GMT /vol/vol0/(1) Options (b=63, B=1000000, 
u)

dmp Thu Sep 20 01:11:22 GMT /vol/vol0/(1) Snapshot 
(snapshot_for_backup.6, Sep 20 01:11:21 GMT)

dmp Sep 20 01:11:22 GMT /vol/vol0/(1) Tape_open (nrst0a)

dmp Sep 20 01:11:22 GMT /vol/vol0/(1) Phase_change (I)

dmp Sep 20 01:11:24 GMT /vol/vol0/(1) Phase_change (II)

dmp Sep 20 01:11:24 GMT /vol/vol0/(1) Phase_change (III)

dmp Sep 20 01:11:26 GMT /vol/vol0/(1) Phase_change (IV)

dmp Sep 20 01:14:19 GMT /vol/vol0/(1) Tape_close (nrst0a)

dmp Sep 20 01:14:20 GMT /vol/vol0/(1) Tape_open (nrst0a)

dmp Sep 20 01:14:54 GMT /vol/vol0/(1) Phase_change (V)

dmp Sep 20 01:14:54 GMT /vol/vol0/(1) Tape_close (nrst0a)

dmp Sep 20 01:14:54 GMT /vol/vol0/(1) End (1224 MB)

There are five phases in a dump operation (map files, map directories, dump directories, dump files, and dump ACLs).

The log file for a dump operation begins with either a Start or Restart event and ends with either an End or Abort event.

Restore events

The event field for a restore event contains an event type followed by event-specific information in parentheses. The following table describes the events, their meanings, and the related event information that might be recorded for a restore operation.

Event	Meaning	Event Information
Start	A restore or NDMP restore begins.	Restore level and the type of restore
Restart	A restore restarts.	Restore level
End	Restores completed successfully.	Number of files and amount of data processed
Abort	The operation aborts.	Number of files and amount of data processed
Options	Specified options are listed.	All options and their associated values, including NDMP options
Tape_open	The tape is open for read/write.	The new tape device name
Tape_close	The tape is closed for read/write.	The tape device name
Phase-change	Restore is entering a new processing phase.	The new phase name
Error	Restore encounters an unexpected event.	Error message

Example for restore

The following is an example of the output for a restore operation:

rst Thu Sep 20 02:24:22 GMT /vol/rst_vol/ Start (level 0)

rst Thu Sep 20 02:24:22 GMT /vol/rst_vol/ Options (r)

rst Thu Sep 20 02:24:22 GMT /vol/rst_vol/ Tape_open (nrst0a)

rst Thu Sep 20 02:24:23 GMT /vol/rst_vol/ Phase_change (Dirs)

rst Thu Sep 20 02:24:24 GMT /vol/rst_vol/ Phase_change (Files)

rst Thu Sep 20 02:39:33 GMT /vol/rst_vol/ Tape_close (nrst0a)

rst Thu Sep 20 02:39:33 GMT /vol/rst_vol/ Tape_open (nrst0a)

rst Thu Sep 20 02:44:22 GMT /vol/rst_vol/ Tape_close (nrst0a)

rst Thu Sep 20 02:44:22 GMT /vol/rst_vol/ End (3516 files, 1224 MB)

There are two phases in a restore operation (restore directories and restore files).

The log file for a restore operation begins with either a Start or Restart event and ends with either an End or Abort event.

Example of an aborted restore

The following is an example of the output of an aborted restore operation:

rst Thu Sep 20 02:13:54 GMT /rst_vol/ Start (Level 0)

rst Thu Sep 20 02:13:54 GMT /rst_vol/ Options (r)

rst Thu Sep 20 02:13:54 GMT /rst_vol/ Tape_open (nrst0a)

rst Thu Sep 20 02:13:55 GMT /rst_vol/ Phase_change (Dirs)

rst Thu Sep 20 02:13:56 GMT /rst_vol/ Phase_change (Files)

rst Thu Sep 20 02:23:40 GMT /vol/rst_vol/ Error (Interrupted)

rst Thu Sep 20 02:23:40 GMT /vol/rst_vol/ Tape_close (nrst0a)

rst Thu Sep 20 02:23:40 GMT /vol/rst_vol/ Abort (3516 files, 598 
MB)