Event monitor file management

With some event monitors, you can have event data written to text files. You can configure some upper bounds on the number of files created, as well as their size with options on the CREATE or ALTER EVENT MONITOR statements.

A file event monitor enables the event monitor to store its event records in files. All the output of the event monitor goes in the directory supplied in the FILE parameter for the CREATE EVENT MONITOR statement. Before the monitor is activated, the directory must exist, or the SET EVENT MONITOR command will return an error; the directory will not be created by the database manager if it does not already exist.
Important: When a file event monitor is first activated, a control file named db2event.ctl is created in this directory. Do not remove or modify this file.

By default, an event monitor writes its trace to a single file, called 00000000.evt. This file keeps growing as long as there is space on the file system. If you specified a file size limit with the MAXFILESIZE parameter of the CREATE EVENT MONITOR statement, then when a file is full, output is directed to a new file. The number that makes up the file name is increased by 1 each time a new file is created. Hence, the active file is the file with the highest number.

You can limit the maximum size of the entire event monitor trace by also using the MAXFILES parameter of the CREATE EVENT MONITOR statement. When the number of files reaches the maximum defined by MAXFILES, the event monitor deactivates itself and the following message is written to the administration notification log. 
DIA1601I Event Monitor monitor-name was deactivated when it reached
its preset MAXFILES and MAXFILESIZE limit.
If you receive this message, do not delete any of the event monitor files. If you do, you will not be able to view any of the event monitor information (even that contained in any remaining files) using the db2evmon command. Instead take one of the following actions:
  • Recreate the event monitor without the MAXFILES and MAXFILESIZE limits.
  • Leave the limits imposed by the MAXFILES and MAXFILESIZE parameters in place, but move all but the most recent *.evt files in the directory to another directory or file system. You can then view the event monitor information from the files in the new directory. You can create a script to do this automatically if you want.
Either way, you must reactivate the event monitor using the statement SET EVENT MONITOR event-monitor-name STATE 1 to start collecting information again after you receive the DIA1601I message.

When a file event monitor is restarted, it can either erase any existing data or append new data to it. This option is specified in the CREATE EVENT MONITOR statement, where either an APPEND monitor or a REPLACE monitor can be created. APPEND is the default option. An APPEND event monitor starts writing at the end of the file it was last using. If you have removed that file, the next file number in sequence is used. When an append event monitor is restarted, only a start_event is generated. The event log header and database header are generated only for the first activation. A REPLACE event monitor always deletes existing event files and starts writing at 00000000.evt.

Note: If you did not use the REPLACE option for the event monitor, you can perform the following steps to force the event monitor to start collecting a new set of data:
  1. Deactivate the event monitor using the SET EVENT MONITOR event-monitor-name STATE 0 command.
  2. Delete all files in the directory that was specified by the FILE option of the CREATE EVENT MONITOR statement.
  3. Reactivate the event monitor using the SET EVENT MONITOR event-monitor-name STATE 1 command.

If a file event monitor runs out of disk space, it shuts itself down after logging a system-error-level message in the administration notification log.

You might want to process monitor data while the event monitor is active. This is possible, and furthermore, when you are finished processing a file, you can delete it, freeing up space for further monitoring data. An event monitor cannot be forced to switch to the next file unless you stop and restart it. It must also be in APPEND mode. To track which events have been processed in the active file, you can create an application that simply tracks the file number and location of the last record processed. When processing the trace the next time around, the application can seek to that file location.