1# HiSysEvent
2
3HiSysEvent is a built-in tool that helps you subscribe to real-time system events and query historical system events. To use this tool, access the target device with [hdc](hdc.md) and then run **hisysevent** commands in the command-line interface (CLI).
4
5## Subscribing to Real-Time System Events
6
7- Run the **hisysevent -r** command to subscribe to system events.
8
9   ![](figures/hisysevent-r.png)
10
11- To specify the type of system event to subscribe to, use the **-g** option.
12
13  > **NOTE**<br>
14  > With the **-g** option, four event types are available: **FAULT**, **STATISTIC**, **SECURITY**, and **BEHAVIOR**.
15  >
16  > If no event type is specified, HiSysEvent subscribes to all types of system events.
17
18  Example: Subscribe to system events of the **FAULT** type.
19
20  ![](figures/hisysevent-r-g.png)
21
22- To subscribe to system events by event domain and event name, use the **-o**, **-n**, and **-c** options. **-o** specifies the event domain, **-n** specifies the event name, and **-c** specifies the rule for matching the specified event domain and name.
23
24  > **NOTE**<br>
25  > With the **-c** option, the following matching rules are available: **WHOLE_WORD**, **PREFIX**, and **REGULAR**.
26  >
27  > If no matching rule is specified, the **WHOLE_WORD** matching rule is used by default.
28
29  Example 1: Subscribe to the system event that matches the domain of **AAFWK** and event name of **CONNECT_SERVICE**.
30
31  ![](figures/hisysevent-r-o-wholeword.png)
32
33  Example 2: Subscribe to system events that match the domain prefix of **AAF** and event name prefix of **CONNECT**.
34
35  ![](figures/hisysevent-r-o-prefix.png)
36
37  Example 3: Subscribe to system events whose domain matches the **AA\*** regular expression and whose event name matches the **CONNE\*** regular expression.
38
39  ![](figures/hisysevent-r-o-regular.png)
40
41- To subscribe to system events by event tag, use the **-t** and **-c** options. **-t** specifies the event tag, and **-c** specifies the rule for matching the event tag.
42
43  Example 1: Subscribe to system events whose tag is **ability**.
44
45  ![](figures/hisysevent-r-t-wholeword.png)
46
47  Example 2: Subscribe to system events whose tag prefix is **abili**.
48
49  ![](figures/hisysevent-r-t-prefix.png)
50
51  Example 3: Subscribe to system events whose tag matches the **abi\*** regular expression.
52
53  ![](figures/hisysevent-r-t-regular.png)
54
55## Querying Historical System Events
56
57- Run the **hisysevent -l** command to query system events that are stored.
58
59  ![](figures/hisysevent-l.png)
60
61- To specify the type of system event to query, use the **-g** option.
62
63  > **NOTE**<br>
64  > With the **-g** option, four event types are available: **FAULT**, **STATISTIC**, **SECURITY**, and **BEHAVIOR**.
65  >
66  > If no event type is specified, HiSysEvent queries all types of system events.
67
68  Example: Query system events of the **SECURITY** type.
69
70  ![](figures/hisysevent-l-g.png)
71
72- To query historical system events within the specified period of time, use the **-s** and **-e** options to specify raw timestamps. **-s** specifies the start timestamp, and **-e** the end timestamp.
73
74  > **NOTE**<br>
75  > The raw timestamps are of millisecond precision.
76
77  Example: Query all system events reported between 1708604541551 and 1708604558551.
78
79  ![](figures/hisysevent-l-s-e.png)
80
81- You can use the **-S** and **-E** options to specify formatted start and end timestamps, respectively.
82
83  > **NOTE**<br>
84  > The timestamp format is YYYY-MM-DD hh:mm:ss.
85
86  Example: Query all system events reported between 2024-02-22 20:22:21 and 2024-02-22 20:22:38.
87
88  ![](figures/hisysevent-l-S-E-format.png)
89
90- To query system events by event domain and event name, use the **-o**, **-n**, and **-c** options. **-o** specifies the event domain, **-n** specifies the event name, and **-c** specifies the rule for matching the specified event domain and name.
91
92  > **NOTE**<br>
93  > The **-c** option for querying historical system events must be **WHOLE_WORD**.
94  >
95  > If no matching rule is specified, the **WHOLE_WORD** matching rule is used by default.
96
97  Example: Query the system event that matches the domain of **AAFWK** and event name of **CONNECT_SERVICE**.
98
99  ![](figures/hisysevent-l-o-n-c.png)
100
101- You can use the **-m** option to set the maximum number of historical events that can be queried.
102
103  > **NOTE**<br>
104  > If **-m** is not specified, a maximum of 10,000 system events are queried by default.
105
106  ![](figures/hisysevent-l-m.png)
107
108  ![](figures/hisysevent-l-wc-l.png)
109
110## Checking System Event Validity
111
112To enable system event validity check, use the **-v** option.
113
114If system event validity check is enabled, invalid content contained in system events will be highlighted in red.
115
116> **NOTE**<br>
117>
118> Invalid content is defined as follows:
119>
120> - Custom parameter key that is not configured
121> - Type mismatch
122
123Example: For the system event named **INTERACTION_APP_JANK** of the **ACE** domain, the <!--RP1-->[system event configuration](../../device-dev/subsystems/subsys-dfx-hisysevent-logging-config.md)<!--RP1End--> does not contain the custom parameters **DURITION** and **DISPLAY_ANIMATOR**. If these parameters are contained in the event saved, they will be highlighted in red when system event validity check is enabled.
124
125![](figures/hisysevent-v.png)
126