BUF_WRAP and EVENT_OVERFLOW

Edit online

If unread data is overwritten by data from a new event occurrence, the keyword BUF_WRAP will be the first output from a read() on the monitor file. If there is a buffer wrap AND an event overflow, the BUF_WRAP will always come first, followed by the EVENT_OVERFLOW. Here is an example output from read() in the case where we have both a buffer wrap and an event overflow:

First read() will return:

BUF_WRAP

Second read() will return:

EVENT_OVERFLOW

Third read() will return the event data that was able to fit inside the buffer:

BEGIN_EVENT_INFO
TIME_tvsec=1269863383
TIME_tvnsec=455993143
SEQUENCE_NUM=0
PID=6947038
UID=0
UID_LOGIN=0
GID=0
PROG_NAME=cat
RC_FROM_EVPROD=1000
BEGIN_EVPROD_INFO
event producer message here
END_EVPROD_INFO
STACK_TRACE
ahafs_prod_callback+3C4
ahafs_cbfn_wrapper+30
ahafs_vn_write+204
vnop_rdwr+7E4
vno_rw+B4
rwuio+12C
rdwr+184
kewrite+16C
.svc_instr
write+1A4
_xwri

If event information is coming fast enough, it is possible to receive two BUF_WRAP entries in a row. If you are seeing BUF_WRAP, increase the size of the buffer (using BUF_SIZE when writing to the monitor file).