BUF_WRAP and EVENT_OVERFLOW
If unread data is overwritten by data from a new event occurrence, the keyword BUF_WRAP will be the first output from a read() on the monitor file. If there is a buffer wrap AND an event overflow, the BUF_WRAP will always come first, followed by the EVENT_OVERFLOW. Here is an example output from read() in the case where we have both a buffer wrap and an event overflow:
First read() will return:
Second read() will return:
Third read() will return the event data that was able to fit inside the buffer:
BEGIN_EVENT_INFO TIME_tvsec=1269863383 TIME_tvnsec=455993143 SEQUENCE_NUM=0 PID=6947038 UID=0 UID_LOGIN=0 GID=0 PROG_NAME=cat RC_FROM_EVPROD=1000 BEGIN_EVPROD_INFO event producer message here END_EVPROD_INFO STACK_TRACE ahafs_prod_callback+3C4 ahafs_cbfn_wrapper+30 ahafs_vn_write+204 vnop_rdwr+7E4 vno_rw+B4 rwuio+12C rdwr+184 kewrite+16C .svc_instr write+1A4 _xwri
If event information is coming fast enough, it is possible to receive two BUF_WRAP entries in a row. If you are seeing BUF_WRAP, increase the size of the buffer (using BUF_SIZE when writing to the monitor file).