Android EventLog简介

---

前言

在 Android 开发中，EventLog是一种系统日志记录机制，用于记录 Android 系统的事件和信息。EventLog 记录的日志通常用于诊断和分析应用程序或系统的运行过程，以便开发人员了解应用程序的行为、性能和问题。
通过EventLog来分析Activity、Process、CPU、Window等相关信息。

一、EventLog使用

adb logcat -b events > event.log

获取到的信息基本上如：

06-14 13:36:12.677   481   481 I chatty  : uid=1000(system) hwservicemanage expire 12 lines
06-14 13:36:36.090  1510  1998 I service_manager_stats: [100,106,73258]
06-14 13:36:37.086   481   481 I chatty  : uid=1000(system) hwservicemanage expire 34 lines
06-14 13:36:41.273  1510  2017 I battery_level: [86,4364,254]
06-14 13:37:45.101  1510  2017 I battery_level: [87,4365,254]
06-14 13:37:46.532   481   481 I chatty  : uid=1000(system) hwservicemanage expire 10 lines
06-14 13:37:52.349  1510  1998 I service_manager_stats: [100,97,76259]
06-14 13:37:53.220  1510  1651 I sysui_multi_action: [757,1696,758,6,759,2]
06-14 13:37:55.408  1510 21888 I dvm_lock_sample: [system_server,1,Binder:1510_20,5,PackageManagerService.java,5703,int com.android.server.pm.PackageManagerService.checkUidPermission(java.lang.String, int),-,5703,int com.android.server.pm.PackageManagerService.checkUidPermission(java.lang.String, int),1]
06-14 13:37:58.165  1510  2017 I battery_status: [5,2,1,2,Li-ion]
06-14 13:38:00.209  1510  1651 I power_sleep_requested: 0
06-14 13:38:00.271  1510  1651 I sysui_multi_action: [757,1696,758,6,759,0]
06-14 13:38:00.729  1510  1651 I am_pause_activity: [0,3267794,com.android.launcher3/.Launcher,userLeaving=false]
06-14 13:38:00.730  2401  2401 I am_on_top_resumed_lost_called: [0,com.android.launcher3.Launcher,topStateChangedWhenResumed]
06-14 13:38:00.734  2401  2401 I am_on_paused_called: [0,com.android.launcher3.Launcher,performPause]
06-14 13:38:00.746  1510 21888 I am_add_to_stopping: [0,3267794,com.android.launcher3/.Launcher,completePauseLocked]
06-14 13:38:00.759  1510  1613 I am_stop_activity: [0,3267794,com.android.launcher3/.Launcher]
06-14 13:38:00.760  1510  1613 I sysui_multi_action: [757,803,799,window_time_0,802,1801]
06-14 13:38:00.767  2401  2401 I am_on_stop_called: [0,com.android.launcher3.Launcher,sleeping]
06-14 13:38:01.018  1510  1621 I am_meminfo: [1092882432,124772352,5869568,348860416,583215104]
06-14 13:38:01.033  1510  1621 I am_pss  : [26028,10162,com.example.hxplay,110610432,94441472,0,227602432,1,16,13]
06-14 13:38:01.045  1510  1610 I sysui_multi_action: [757,223,758,1]
06-14 13:38:01.046  1510  1621 I am_pss  : [11871,10058,org.codeaurora.snapcam,41068544,27508736,0,164261888,1,17,10]
06-14 13:38:01.062  1510  1621 I am_pss  : [31144,10115,com.qualcomm.qti.seccamservice:remote,8309760,4595712,106496,95776768,1,20,8]
06-14 13:38:01.073  2036  2036 I sysui_multi_action: [757,111,758,1]
06-14 13:38:01.073  1510  1621 I am_pss  : [20962,10144,com.henry.basic,46262272,37482496,339968,153845760,1,17,10]
06-14 13:38:01.074  2036  2036 I sysui_multi_action: [757,126,758,1,759,126,927,0,928,1,1593,0]
06-14 13:38:01.075  2036  2036 I sysui_multi_action: [757,113,758,1,759,113,927,1,928,0,1593,0]
06-14 13:38:01.075  2036  2036 I sysui_multi_action: [757,118,758,1,759,118,927,2,928,0,1593,0]
06-14 13:38:01.076  2036  2036 I sysui_multi_action: [757,119,758,1,759,119,927,3,928,0,1593,0]
06-14 13:38:01.077  2036  2036 I sysui_multi_action: [757,123,758,1,759,123,927,4,928,0,1593,0]
06-14 13:38:01.077  2036  2036 I sysui_multi_action: [757,261,758,1,759,261,927,5,928,0,1593,0]
06-14 13:38:01.082  1510  1621 I am_pss  : [1216,10160,com.android.audiotest,27436032,21733376,2049024,110301184,1,17,7]
06-14 13:38:01.095  1510  1621 I am_pss  : [19949,10051,com.android.providers.calendar,7484416,5378048,0,86237184,1,20,6]
06-14 13:38:01.101  2036  2036 I sysui_multi_action: [757,196,758,2,759,0]
06-14 13:38:01.102  2036  2036 I sysui_status_bar_state: [1,0,0,0,0,1]
06-14 13:38:01.103  1510  1621 I am_pss  : [32102,10146,com.han.devtool,12112896,9949184,0,88309760,1,20,7]
06-14 13:38:01.112  1510  3114 I sysui_multi_action: [757,127,758,1]
06-14 13:38:01.112  1510  3114 I sysui_multi_action: [757,804,799,note_load,801,3,802,1]
06-14 13:38:01.112  1510  1621 I am_pss  : [32086,10161,org.schabi.newpipe,23066624,19763200,0,110485504,1,20,7]
06-14 13:38:01.112  1510  3114 I notification_panel_revealed: 3
......

---

二、EventLog语义规则分析

以进程启动为例

am_proc_start (User|1|5),(PID|1|5),(UID|1|5),(Process Name|3),(Type|3),(Component|3)

am_proc_start之后紧跟着的几个括号，其中括号里的内容格式如下：

(<name>|data type[|data unit])
(<名字>|数据类型[|数据单位])

其中(User|1|5) ==> 名字为User, 数据类型为1，数据单位为5，下面再来看看数据类型和数据单位：

每一种Tag由于功能和模块的不同，括号中的内容不同，但是都遵循以下规则：

（Name|type|unit）

• Name：表示这个字段的意义
• Type：表示这个字段的数据类型，取值为：

1: int
2: long
3: string
4: list
5: float

数据类型中int和string用得最多.

unit，取值为

1: Number of objects(对象个数)
2: Number of bytes(字节数)
3: Number of milliseconds(毫秒)
4: Number of allocations(分配个数)
5: Id
6: Percent(百分比)
s: Number of seconds (monotonic time)

例如：

am_proc_start (User|1|5),(PID|1|5),(UID|1|5),(Process Name|3),(Type|3),(Component|3)
am_proc_start: [0,9227,10002,com.android.browser,content provider,com.android.browser/.provider.BrowserProvider2]

含义如下：

进程启动: UserId=0, pid=9227, uid=10002, ProcessName=com.android.browser, 数据类型=ContentProvider, 组件=com.android.browser/.provider.BrowserProvider2

再来一个例子

 am_proc_start (User|1|5),(PID|1|5),(UID|1|5),(Process Name|3),(Type|3),(Component|3)
 am_proc_start: [0,6533,10131,com.jingdong.app.mall:WatchDogService,service,com.jingdong.app.mall/com.jingdong.common.watchdog.WatchDogService]

含义：

启动一个进程，UserId=0,PID=6533,UID=10131,ProcessName=com.jingdong.app.mall:WatchDogService,Type=service,Component=com.jingdong.app.mall/com.jingdong.common.watchdog.WatchDogService

Tips:
events_log中搜索“am_finish_activity”， 可以判断到底是APP自行结束的（正常结束，后面有app-request字样），还是被其他进程强制结束的(force-stop)

三、EventLog分类

3.1 ActivityManager

TagName	格式	功能
am_finish_activity	User,Token,TaskID,ComponentName,Reason
am_task_to_front	User,Task
am_new_intent	User,Token,TaskID,ComponentName,Action,MIMEType,URI,Flags
am_create_task	User ,Task ID
am_create_activity	User ,Token ,TaskID ,ComponentName,Action,MIMEType,URI,Flags
am_restart_activity	User ,Token ,TaskID,ComponentName
am_resume_activity	User ,Token ,TaskID,ComponentName
am_anr	User ,pid ,Package Name,Flags ,reason	ANR
am_activity_launch_time	User ,Token ,ComponentName,time
am_proc_bound	User ,PID ,ProcessName
am_proc_died	User ,PID ,ProcessName
am_failed_to_pause	User ,Token ,Wanting to pause,Currently pausing
am_pause_activity	User ,Token ,ComponentName
am_proc_start	User ,PID ,UID ,ProcessName,Type,Component
am_proc_bad	User ,UID ,ProcessName
am_proc_good	User ,UID ,ProcessName
am_low_memory	NumProcesses	Lru
am_destroy_activity	User ,Token ,TaskID,ComponentName,Reason
am_relaunch_resume_activity	User ,Token ,TaskID,ComponentName
am_relaunch_activity	User ,Token ,TaskID,ComponentName
am_on_paused_called	User ,ComponentName
am_on_resume_called	User ,ComponentName
am_kill	User ,PID ,ProcessName,OomAdj ,Reason	杀进程
am_broadcast_discard_filter	User ,Broadcast ,Action,ReceiverNumber,BroadcastFilter
am_broadcast_discard_app	User ,Broadcast ,Action,ReceiverNumber,App
am_create_service	User ,ServiceRecord ,Name,UID ,PID
am_destroy_service	User ,ServiceRecord ,PID
am_process_crashed_too_much	User ,Name,PID
am_drop_process	PID
am_service_crashed_too_much	User ,Crash Count,ComponentName,PID
am_schedule_service_restart	User ,ComponentName,Time
am_provider_lost_process	User ,Package Name,UID ,Name
am_process_start_timeout	User ,PID ,UID ,ProcessName	timeout
am_crash	User ,PID ,ProcessName,Flags ,Exception,Message,File,Line	Crash
am_wtf	User ,PID ,ProcessName,Flags ,Tag,Message	Wtf
am_switch_user	id
am_activity_fully_drawn_time	User ,Token ,ComponentName,time
am_focused_activity	User ,ComponentName
am_home_stack_moved	User ,To Front ,Top Stack Id ,Focused Stack Id ,Reason
am_pre_boot	User ,Package
am_meminfo	Cached,Free,Zram,Kernel,Native	内存
am_pss	Pid, UID, ProcessName, Pss, Uss	进程

可能使用的部分场景：

am_low_memory：位于AMS.killAllBackgroundProcesses或者AMS.appDiedLocked，记录当前Lru进程队列长度。
am_pss：位于AMS.recordPssSampleLocked(
am_meminfo：位于AMS.dumpApplicationMemoryUsage
am_proc_start:位于AMS.startProcessLocked，启动进程
am_proc_bound:位于AMS.attachApplicationLocked
am_kill: 位于ProcessRecord.kill，杀掉进程
am_anr: 位于AMS.appNotResponding
am_crash:位于AMS.handleApplicationCrashInner
am_wtf:位于AMS.handleApplicationWtf
am_activity_launch_time：位于ActivityRecord.reportLaunchTimeLocked()，后面两个参数分别是thisTime和 totalTime.
am_activity_fully_drawn_time:位于ActivityRecord.reportFullyDrawnLocked, 后面两个参数分别是thisTime和 totalTime
am_broadcast_discard_filter:位于BroadcastQueue.logBroadcastReceiverDiscardLocked
am_broadcast_discard_app:位于BroadcastQueue.logBroadcastReceiverDiscardLocked

Activity生命周期相关的方法:

am_on_resume_called: 位于AT.performResumeActivity
am_on_paused_called: 位于AT.performPauseActivity, performDestroyActivity
am_resume_activity: 位于AS.resumeTopActivityInnerLocked
am_pause_activity: 位于AS.startPausingLocked
am_finish_activity: 位于AS.finishActivityLocked, removeHistoryRecordsForAppLocked
am_destroy_activity: 位于AS.destroyActivityLocked
am_focused_activity: 位于AMS.setFocusedActivityLocked, clearFocusedActivity
am_restart_activity: 位于ASS.realStartActivityLocked
am_create_activity: 位于ASS.startActivityUncheckedLocked
am_new_intent: 位于ASS.startActivityUncheckedLocked
am_task_to_front: 位于AS.moveTaskToFrontLocked

3.2 WindowManager相关

wm_no_surface_memory (Window|3),(PID|1|5),(Operation|3)
wm_task_created (TaskId|1|5),(StackId|1|5)
wm_task_moved (TaskId|1|5),(ToTop|1),(Index|1)
wm_task_removed (TaskId|1|5),(Reason|3)
wm_stack_created (StackId|1|5)
wm_home_stack_moved (ToTop|1)
wm_stack_removed (StackId|1|5)
wm_boot_animation_done (time|2|3)

3.3 Power相关

TagName	格式	功能
battery_level	level, voltage, temperature
battery_status	status,health,present,plugged,technology
battery_discharge	duration, minLevel,maxLevel
power_sleep_requested	wakeLocksCleared	唤醒锁数量
power_screen_broadcast_send	wakelockCount
power_screen_broadcast_done	on, broadcastDuration, wakelockCount
power_screen_broadcast_stop	which,wakelockCount	系统还没进入ready状态
power_screen_state	offOrOn, becauseOfUser, totalTouchDownTime, touchCycles
power_partial_wake_state	releasedorAcquired, tag

部分含义：

battery_level: [19,3660,352] //剩余电量19%, 电池电压3.66v, 电池温度35.2℃
power_screen_state: [0,3,0,0] // 灭屏状态(0), 屏幕超时(3). 当然还有其他设备管理策略，其他理由都为用户行为
power_screen_state: [1,0,0,0] // 亮屏状态(1)

可能使用的部分场景：

power_sleep_requested: 位于PMS.goToSleepNoUpdateLocked
power_screen_state:位于Notifer.handleEarlyInteractiveChange, handleLateInteractiveChange

3.4 Notification相关

notification_panel_revealed (items|1)
notification_panel_hidden
notification_visibility_changed (newlyVisibleKeys|3),(noLongerVisibleKeys|3)
notification_expansion (key|3),(user_action|1),(expanded|1),(lifespan|1),(freshness|1),(exposure|1)
notification_clicked (key|3),(lifespan|1),(freshness|1),(exposure|1),(rank|1),(count|1)
notification_action_clicked (key|3),(action_index|1),(lifespan|1),(freshness|1),(exposure|1),(rank|1),(count|1)
notification_canceled (key|3),(reason|1),(lifespan|1),(freshness|1),(exposure|1),(rank|1),(count|1),(listener|3)
notification_visibility (key|3),(visibile|1),(lifespan|1),(freshness|1),(exposure|1),(rank|1)
notification_alert (key|3),(buzz|1),(beep|1),(blink|1)
notification_autogrouped (key|3)