Android系统日志1-EventLog

1、查看方式

(base) caros@computing:~$ adb logcat -b events
01-18 16:50:03.568   154   154 I auditd  : type=2000 audit(0.0:1): state=initialized audit_enabled=0 res=1
01-18 16:50:06.126   154   154 I auditd  : type=1403 audit(0.0:2): auid=4294967295 ses=4294967295 lsm=selinux res=1
01-18 16:50:06.947   155   155 I auditd  : SELinux: Loaded service_contexts from:
01-18 16:50:06.948   155   155 I auditd  :     /system/etc/selinux/plat_service_contexts
01-18 16:50:08.253   141   141 I auditd  : type=1400 audit(0.0:3): avc: denied { setattr } for comm="init" name="nfc" dev="mmcblk2p15" ino=450561 scontext=u:r:vendor_init:s0 tcontext=u:object_r:system_data_file:s0 tclass=dir permissive=1
01-18 16:50:08.253   141   141 I auditd  : type=1400 audit(0.0:4): avc: denied { read } for comm="init" name="nfc" dev="mmcblk2p15" ino=450561 scontext=u:r:vendor_init:s0 tcontext=u:object_r:system_data_file:s0 tclass=dir permissive=1
01-18 16:50:08.253   141   141 I auditd  : type=1400 audit(0.0:5): avc: denied { open } for comm="init" path="/data/nfc" dev="mmcblk2p15" ino=450561 scontext=u:r:vendor_init:s0 tcontext=u:object_r:system_data_file:s0 tclass=dir permissive=1
01-18 16:50:08.253   141   141 I auditd  : type=1400 audit(0.0:6): avc: denied { ioctl } for comm="init" path="/data/nfc" dev="mmcblk2p15" ino=450561 ioctlcmd=0x6615 scontext=u:r:vendor_init:s0 tcontext=u:object_r:system_data_file:s0 tclass=dir permissive=1
01-18 16:50:08.483   266   266 I auditd  : type=1400 audit(0.0:7): avc: denied { read } for comm="android.hardwar" name="u:object_r:system_prop:s0" dev="tmpfs" ino=19533 scontext=u:r:hal_health_default:s0 tcontext=u:object_r:system_prop:s0 tclass=file permissive=1
01-18 16:50:08.483   266   266 I auditd  : type=1400 audit(0.0:8): avc: denied { open } for comm="android.hardwar" path="/dev/__properties__/u:object_r:system_prop:s0" dev="tmpfs" ino=19533 scontext=u:r:hal_health_default:s0 tcontext=u:object_r:system_prop:s0 tclass=file permissive=1
01-18 16:50:08.483   266   266 I auditd  : type=1400 audit(0.0:9): avc: denied { getattr } for comm="android.hardwar" path="/dev/__properties__/u:object_r:system_prop:s0" dev="tmpfs" ino=19533 scontext=u:r:hal_health_default:s0 tcontext=u:object_r:system_prop:s0 tclass=file permissive=1
01-18 16:50:08.483   266   266 I auditd  : type=1400 audit(0.0:10): avc: denied { map } for comm="android.hardwar" path="/dev/__properties__/u:object_r:system_prop:s0" dev="tmpfs" ino=19533 scontext=u:r:hal_health_default:s0 tcontext=u:object_r:system_prop:s0 tclass=file permissive=1
01-18 16:50:08.492   250   250 I boot_progress_start: 4982

2、源码使用

EventLog.writeEvent(EventLogTags.BOOT_PROGRESS_PMS_SYSTEM_SCAN_START,
                    startTime);

3、tag定义

通过查看Android系统源码，如 EventLogTags.BOOT_PROGRESS_PMS_SYSTEM_SCAN_START 这类tag信息并没有在java文件中定义，经查阅资料发现这些tag信息是在编译时生成的。
参考：https://blog.csdn.net/yfbdxz/article/details/114702144
1、相关编译脚本：

 android/build/tools 目录下有三个event_log相关的脚本  
        event_log_tags.py //读取跟解析event_log_tags文件
        java-event-log-tags.py //把EventLogTags.logtags文件翻成java
        merge-event-log-tags.py //把多个EventLogTags.logtags合并成一个,并检查number冲突
    
    merge-event-log-tags.py使用及/system/etc/event-log-tags文件创建时间点  
        详见:android/build/core/Makefile -- .PHONY: event-log-tags

2、EventLogTags.logtags编译时被翻译成了java

    frameworks/base/core/java/com/android/internal/logging/EventLogTags.logtags
    
        option java_package com.android.internal.logging;
        524287 sysui_view_visibility (category|1|5),(visible|1|6)
        524288 sysui_action (category|1|5),(pkg|3)
        524290 sysui_count (name|3),(increment|1)
        524291 sysui_histogram (name|3),(bucket|1)
    
    out/target/common/obj/JAVA_LIBRARIES/framework_intermediates/src/.../logging/EventLogTags.java
    
        public class EventLogTags {
          private EventLogTags() { }  // don't instantiate
        
          /** 524287 sysui_view_visibility (category|1|5),(visible|1|6) */
          public static final int SYSUI_VIEW_VISIBILITY = 524287;
        
          /** 524288 sysui_action (category|1|5),(pkg|3) */
          public static final int SYSUI_ACTION = 524288;
        
          /** 524290 sysui_count (name|3),(increment|1) */
          public static final int SYSUI_COUNT = 524290;
        
          /** 524291 sysui_histogram (name|3),(bucket|1) */
          public static final int SYSUI_HISTOGRAM = 524291;
        
          public static void writeSysuiViewVisibility(int category, int visible) {
            android.util.EventLog.writeEvent(SYSUI_VIEW_VISIBILITY, category, visible);
          }
        
          public static void writeSysuiAction(int category, String pkg) {
            android.util.EventLog.writeEvent(SYSUI_ACTION, category, pkg);
          }
        
          public static void writeSysuiCount(String name, int increment) {
            android.util.EventLog.writeEvent(SYSUI_COUNT, name, increment);
          }
        
          public static void writeSysuiHistogram(String name, int bucket) {
            android.util.EventLog.writeEvent(SYSUI_HISTOGRAM, name, bucket);
          }
        }

3、编译后的位置

4、查看源码定义，在源码中直接搜对应的tag 小写就可以
我们按照这个EventLogTags.BOOT_PROGRESS_PMS_SYSTEM_SCAN_START 来说：

可以看到对应的tag在这里。

4、查找日志中的tag

直接grep源码中的tag关键词即可

5、查看所有tag

格式定义如下：

参考：https://blog.csdn.net/yaowei514473839/article/details/53513435