Tutorial Lpg Eaver

An Introduction to log eaver (v2.8)Jean Goubault-LarrecqGIE Dyade, INRIA Rocquencourt LSV, ENS CachanDomaine de Voluceau, BP 105 61, av. du president-W´ ilson78153 Le Chesnay Cedex 94235 Cachan CedexSeptember 20, 2001Contents1 Introduction 22 Architecture 33 First Steps: Detecting Repeated Mouse Problems in Linux 43.1 Log Format and Preprocessors . . . . . . . . . . . . . . . . . . . . . . . . . . . 53.2 Basic Record Matching . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63.3 Matching Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73.4 Managing Overlaps: Shortest Matches, Synchronization . . . . . . . . . . . . . 83.5 Refining Rules with Constraints . . . . . . . . . . . . . . . . . . . . . . . . . . 94 Going Further: Loops, Flexible Variables, Checkpointing, and All That 114.1 Repeated Modprobe Problems in Linux . . . . . . . . . . . . . . . . . . . . . . 114.2 Counting, Accumulating Information . . . . . . . . . . . . . . . . . . . . . . . . 134.3 Modes of Operation, End of Files, Streaming and Checkpointing . . . . . . . . . 165 How It Really Works 185.1 Basic Notions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185.2 Thread Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215.3 Synchronized Rules and Merging Pids . . . . . . . . . . . . . . . . . . . . . . . 255.4 Anchored Signatures . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...