[转] Android开发中EventLog分析
概要
在平时开发和处理bug的过程中经常会和EventLog打交到，通过EventLog来分析Activity、Process、CPU、Window等相关信息。
在开发调试中可以通过如下命令查看EventLog信息：
adb logcat -b events
在分析bug的时候可以从log中打开如下文件查看EventLog信息：
event.log
这两种方式获取到的信息基本上如：
01-06 18:54:07.783 886 1469 I am_uid_active: 1037
01-06 18:54:07.787 886 1469 I am_proc_bound: [0,1659,WebViewLoader-arm64-v8a]
01-06 18:54:07.790 886 1130 I am_proc_start: [0,1692,1001,com.qualcomm.qcrilmsgtunnel,service,com.qualcomm.qcrilmsgtunnel/.QcrilMsgTunnelService]
01-06 18:54:07.791 886 1128 I am_wtf : [0,886,system_server,-1,ActivityManager,Sending non-protected broadcast diagandroid.app.ApplicationState from system 886:system/1000 pkg android]
01-06 18:54:07.934 886 886 I wm_task_created: [1,0]
01-06 18:54:07.937 886 886 I wm_task_moved: [1,0,2147483647]
01-06 18:54:07.938 886 886 I am_create_task: [0,1]
01-06 18:54:07.938 886 886 I am_create_activity: [0,201820164,1,com.android.settings/.FallbackHome,android.intent.action.MAIN,NULL,NULL,276824320]
01-06 18:54:07.938 886 886 I wm_task_moved: [1,0,2147483647]
01-06 18:54:07.957 886 1366 I commit_sys_config_file: [settings-0-0,10]
从EventLog中我们可以获取到不少有用的信息，例如上面 I am_create_task,创建task等，后面的括号中的内容也有很高的价值，下面我们会详细讲解对应的字段
EventLog
EventLog中大概分为如下几类，EventLog在编译之后存放在system/etc/event-log-tags文件中,但是其语法定义在system/core/logcat/event.logtags文件中。
我们需要了解的主要为TagName后面的括号中的内容,每一种Tag由于功能和模块的不同，括号中的内容不同，但是都遵循以下规则：
（Name|type|unit）
Name：表示这个字段的意义
Type：表示这个字段的数据格式，取值为：
1: int
2: long
3: string
4: list
5: float
- unit，取值为
1: Number of objects
2: Number of bytes
3: Number of milliseconds
4: Number of allocations
5: Id
6: Percent
s: Number of seconds (monotonic time)
例如：
30001 am_finish_activity (User|1|5),(Token|1|5),(Task ID|1|5),(Component Name|3),(Reason|3)
在上面的代码中(User|1|5)表示这个字段的意义为User，数据类型为1,1的数据类型对应type的定义为int,5表示数据unit，5的数据类型对应unit中的定义为Id
这些定义主要在系统解析相关字段的时候用于代码生成的映射关系。
ActivityManager相关
30001 am_finish_activity (User|1|5),(Token|1|5),(Task ID|1|5),(Component Name|3),(Reason|3)
30002 am_task_to_front (User|1|5),(Task|1|5)
30003 am_new_intent (User|1|5),(Token|1|5),(Task ID|1|5),(Component Name|3),(Action|3),(MIME Type|3),(URI|3),(Flags|1|5)
30004 am_create_task (User|1|5),(Task ID|1|5)
30005 am_create_activity (User|1|5),(Token|1|5),(Task ID|1|5),(Component Name|3),(Action|3),(MIME Type|3),(URI|3),(Flags|1|5)
30006 am_restart_activity (User|1|5),(Token|1|5),(Task ID|1|5),(Component Name|3)
30007 am_resume_activity (User|1|5),(Token|1|5),(Task ID|1|5),(Component Name|3)
30008 am_anr (User|1|5),(pid|1|5),(Package Name|3),(Flags|1|5),(reason|3)
30009 am_activity_launch_time (User|1|5),(Token|1|5),(Component Name|3),(time|2|3)
30010 am_proc_bound (User|1|5),(PID|1|5),(Process Name|3)
30011 am_proc_died (User|1|5),(PID|1|5),(Process Name|3),(OomAdj|1|5),(ProcState|1|5)
30012 am_failed_to_pause (User|1|5),(Token|1|5),(Wanting to pause|3),(Currently pausing|3)
30013 am_pause_activity (User|1|5),(Token|1|5),(Component Name|3),(User Leaving|3)
30014 am_proc_start (User|1|5),(PID|1|5),(UID|1|5),(Process Name|3),(Type|3),(Component|3)
30015 am_proc_bad (User|1|5),(UID|1|5),(Process Name|3)
30016 am_proc_good (User|1|5),(UID|1|5),(Process Name|3)
30017 am_low_memory (Num Processes|1|1)
30018 am_destroy_activity (User|1|5),(Token|1|5),(Task ID|1|5),(Component Name|3),(Reason|3)
30019 am_relaunch_resume_activity (User|1|5),(Token|1|5),(Task ID|1|5),(Component Name|3)
30020 am_relaunch_activity (User|1|5),(Token|1|5),(Task ID|1|5),(Component Name|3)
30021 am_on_paused_called (User|1|5),(Component Name|3),(Reason|3)
30022 am_on_resume_called (User|1|5),(Component Name|3),(Reason|3)
30023 am_kill (User|1|5),(PID|1|5),(Process Name|3),(OomAdj|1|5),(Reason|3)
30024 am_broadcast_discard_filter (User|1|5),(Broadcast|1|5),(Action|3),(Receiver Number|1|1),(BroadcastFilter|1|5)
30025 am_broadcast_discard_app (User|1|5),(Broadcast|1|5),(Action|3),(Receiver Number|1|1),(App|3)
30030 am_create_service (User|1|5),(Service Record|1|5),(Name|3),(UID|1|5),(PID|1|5)
30031 am_destroy_service (User|1|5),(Service Record|1|5),(PID|1|5)
30032 am_process_crashed_too_much (User|1|5),(Name|3),(PID|1|5)
30033 am_drop_process (PID|1|5)
30034 am_service_crashed_too_much (User|1|5),(Crash Count|1|1),(Component Name|3),(PID|1|5)
30035 am_schedule_service_restart (User|1|5),(Component Name|3),(Time|2|3)
30036 am_provider_lost_process (User|1|5),(Package Name|3),(UID|1|5),(Name|3)
30037 am_process_start_timeout (User|1|5),(PID|1|5),(UID|1|5),(Process Name|3)
30039 am_crash (User|1|5),(PID|1|5),(Process Name|3),(Flags|1|5),(Exception|3),(Message|3),(File|3),(Line|1|5)
30040 am_wtf (User|1|5),(PID|1|5),(Process Name|3),(Flags|1|5),(Tag|3),(Message|3)
30041 am_switch_user (id|1|5)
30042 am_activity_fully_drawn_time (User|1|5),(Token|1|5),(Component Name|3),(time|2|3)
30043 am_set_resumed_activity (User|1|5),(Component Name|3),(Reason|3)
30044 am_focused_stack (User|1|5),(Focused Stack Id|1|5),(Last Focused Stack Id|1|5),(Reason|3)
30045 am_pre_boot (User|1|5),(Package|3)
30046 am_meminfo (Cached|2|2),(Free|2|2),(Zram|2|2),(Kernel|2|2),(Native|2|2)
30047 am_pss (Pid|1|5),(UID|1|5),(Process Name|3),(Pss|2|2),(Uss|2|2),(SwapPss|2|2),(Rss|2|2),(StatType|1|5),(ProcState|1|5),(TimeToCollect|2|2)
30048 am_stop_activity (User|1|5),(Token|1|5),(Component Name|3)
30049 am_on_stop_called (User|1|5),(Component Name|3),(Reason|3)
30050 am_mem_factor (Current|1|5),(Previous|1|5)
30051 am_user_state_changed (id|1|5),(state|1|5)
30052 am_uid_running (UID|1|5)
30053 am_uid_stopped (UID|1|5)
30054 am_uid_active (UID|1|5)
30055 am_uid_idle (UID|1|5)
30056 am_stop_idle_service (UID|1|5),(Component Name|3)
30057 am_on_create_called (User|1|5),(Component Name|3),(Reason|3)
30058 am_on_restart_called (User|1|5),(Component Name|3),(Reason|3)
30059 am_on_start_called (User|1|5),(Component Name|3),(Reason|3)
30060 am_on_destroy_called (User|1|5),(Component Name|3),(Reason|3)
30061 am_remove_task (Task ID|1|5), (Stack ID|1|5)
30062 am_on_activity_result_called (User|1|5),(Component Name|3),(Reason|3)
从相应的Event的定义的TagName以及后面的参数的说明，我们可以拿到在我们分析问题的过程中需要的信息
WindowManager相关
31000 wm_no_surface_memory (Window|3),(PID|1|5),(Operation|3)
31001 wm_task_created (TaskId|1|5),(StackId|1|5)
31002 wm_task_moved (TaskId|1|5),(ToTop|1),(Index|1)
31003 wm_task_removed (TaskId|1|5),(Reason|3)
31004 wm_stack_created (StackId|1|5)
31005 wm_home_stack_moved (ToTop|1)
31006 wm_stack_removed (StackId|1|5)
31007 wm_boot_animation_done (time|2|3)
Power相关
2722 battery_level (level|1|6),(voltage|1|1),(temperature|1|1)
2723 battery_status (status|1|5),(health|1|5),(present|1|5),(plugged|1|5),(technology|3)
2724 power_sleep_requested (wakeLocksCleared|1|1)
2725 power_screen_broadcast_send (wakelockCount|1|1)
2726 power_screen_broadcast_done (on|1|5),(broadcastDuration|2|3),(wakelockCount|1|1)
2727 power_screen_broadcast_stop (which|1|5),(wakelockCount|1|1)
2728 power_screen_state (offOrOn|1|5),(becauseOfUser|1|5),(totalTouchDownTime|2|3),(touchCycles|1|1),(latency|1|3)
2729 power_partial_wake_state (releasedorAcquired|1|5),(tag|3)
2730 battery_discharge (duration|2|3),(minLevel|1|6),(maxLevel|1|6)
2731 power_soft_sleep_requested (savedwaketimems|2)
Notification相关
27500 notification_panel_revealed (items|1)
27501 notification_panel_hidden
27510 notification_visibility_changed (newlyVisibleKeys|3),(noLongerVisibleKeys|3)
27511 notification_expansion (key|3),(user_action|1),(expanded|1),(lifespan|1),(freshness|1),(exposure|1)
27520 notification_clicked (key|3),(lifespan|1),(freshness|1),(exposure|1),(rank|1),(count|1)
27521 notification_action_clicked (key|3),(action_index|1),(lifespan|1),(freshness|1),(exposure|1),(rank|1),(count|1)
27530 notification_canceled (key|3),(reason|1),(lifespan|1),(freshness|1),(exposure|1),(rank|1),(count|1),(listener|3)
27531 notification_visibility (key|3),(visibile|1),(lifespan|1),(freshness|1),(exposure|1),(rank|1)
27532 notification_alert (key|3),(buzz|1),(beep|1),(blink|1)
27533 notification_autogrouped (key|3)
实战
定义：
30014 am_proc_start (User|1|5),(PID|1|5),(UID|1|5),(Process Name|3),(Type|3),(Component|3)
EventLog：
I am_proc_start: [0,6533,10131,com.jingdong.app.mall:WatchDogService,service,com.jingdong.app.mall/com.jingdong.common.watchdog.WatchDogService]
含义：
启动一个进程，UserId=0,PID=6533,UID=10131,ProcessName=com.jingdong.app.mall:WatchDogService,Type=service,Component=com.jingdong.app.mall/com.jingdong.common.watchdog.WatchDogService
