I ran into this topic while searching for something unrelated. I have wondered for a while how I could read Sun Cluster eventlog files. For whatever reason Sun Cluster writes these files in binary format, which is not really helpful. I guess those log files are meant to be seen by Sun engineers only.

I ran into this thread, which points to a utility that decodes the binary format.

The utility runs only on SPARC architecture. I have a copy here in case the original page disappears.

I tested this on Solaris 10 running Sun Cluster 3.1 update 4. The utility has some handy options:

bash-3.00$  ./showev4
Usage: ./showev4 [options below]
[-b ]
starting time - type time_t see ev_ts_sec value
[-e ]
ending time - type time_t see ev_ts_sec value
[-i ]
event requestor - 1=sys 2=oper 3=agent
[-l ]
notification level - 0=info 1=wrn 2=err 3=crit 4=fatal
[-p ]
event publisher - i.e. rgm, dcs,...
[-s ]
subclass - type string see ev_subclass value
[-n ]
nodename - type string see ev_node_name value
[-c ]
clustername - type string see ev_cluster_name value
[-v ]
vendorname - type string see ev_vendor value
[-r ]
returncode - 0=ok 1=fail 2=timeout 3=reconfig 4=other
[-o ]
command - type string see cmd_name value
[-t ]
set timezone - type string i.e US/Eastern

And here is a snippet output of the utility run against eventlog file:

bash-3.00$  ./showev4  ./eventlog.2  |  more
Sun Sep 19 04:20:44 2010
class: EC_Cluster   subclass: ESC_cluster_gds_probe
vendor: SUNW   pub: gds   pid: 2428
cluster_id: 0x4538908A   cluster: bigiron   node: node2
ts_sec: 1284866444   ts_usec: 694348
severity: 0 (Info) initiator: 3 (Agent)
r_name: tomcat-hars
rg_name: apps3-rg   status_msg: Probe has been executed with exit code 0 [/opt/SUNWsctomcat/bin/probe_sctomcat -R tomcat-hars -G apps3-rg -N /opt/SUNWsctomcat/bin/pfile ]

Sun Sep 19 04:20:44 2010
class: EC_Cluster   subclass: ESC_cluster_gds_probe
vendor: SUNW   pub: gds   pid: 2428
cluster_id: 0x4538908A   cluster: bigiron   node: node2
ts_sec: 1284866444   ts_usec: 697301
severity: 0 (Info) initiator: 3 (Agent)
r_name: tomcat-hars
rg_name: apps3-rg   status_msg: The probe result is 0

Sun Sep 19 04:20:46 2010
class: EC_Cluster   subclass: ESC_cluster_gds_probe
vendor: SUNW   pub: gds   pid: 16567
cluster_id: 0x4538908A   cluster: bigiron   node: node1
ts_sec: 1284866446   ts_usec: 650674
severity: 0 (Info) initiator: 3 (Agent)
r_name: samba-hars
rg_name: apps1-rg   status_msg: The probe result is 0

Sun Sep 19 04:20:53 2010
class: EC_Cluster   subclass: ESC_cluster_gds_probe
vendor: SUNW   pub: gds   pid: 2428
cluster_id: 0x4538908A   cluster: bigiron   node: node2
ts_sec: 1284866453   ts_usec: 424657
severity: 0 (Info) initiator: 3 (Agent)
r_name: ftrans-hars
rg_name: apps3-rg   status_msg: The probe result is 0

Sun Sep 19 04:20:53 2010
class: EC_Cluster   subclass: ESC_cluster_gds_probe
vendor: SUNW   pub: gds   pid: 2428
cluster_id: 0x4538908A   cluster: bigiron   node: node2
ts_sec: 1284866453   ts_usec: 452038
severity: 0 (Info) initiator: 3 (Agent)
r_name: appgw-hars
rg_name: apps6-rg   status_msg: The probe result is 0

Handy indeed…