一、EventLog介紹
1. 在平時開發和處理bug的過程中經常會和EventLog打交到，通過EventLog來分析Activity、Process、CPU、Window等相關信息。
查看Event所有的tags
adb shell cat /system/etc/event-log-tags
輸出events日志信息
adb logcat -b events
該命令會輸出帶有時間點、進程號等信息的events log
adb logcat -v threadtime -t 4096 -b events
2. EventLog Tag在編譯之后存放在system/etc/event-log-tags文件中，但是其語法定義在system/core/logcat/event.logtags文件中。我們需要了解的主要為TagName后面的括號中的內容,每一種Tag由於功能和模塊的不同，括號中的內容不同，但是都遵循以下規則：
（Name|type|unit） (1) Name：表示這個字段的意義 (2) Type：表示這個字段的數據格式，取值為： 1: int 2: long 3: string 4: list 5: float (3) unit: 取值為 1: Number of objects 2: Number of bytes 3: Number of milliseconds 4: Number of allocations 5: Id 6: Percent s: Number of seconds (monotonic time)
3.EventLog中大概分為如下幾類
(1) ActivityManager相關：
30001 am_finish_activity (User|1|5),(Token|1|5),(Task ID|1|5),(Component Name|3),(Reason|3) 30002 am_task_to_front (User|1|5),(Task|1|5) 30003 am_new_intent (User|1|5),(Token|1|5),(Task ID|1|5),(Component Name|3),(Action|3),(MIME Type|3),(URI|3),(Flags|1|5) 30004 am_create_task (User|1|5),(Task ID|1|5) 30005 am_create_activity (User|1|5),(Token|1|5),(Task ID|1|5),(Component Name|3),(Action|3),(MIME Type|3),(URI|3),(Flags|1|5) 30006 am_restart_activity (User|1|5),(Token|1|5),(Task ID|1|5),(Component Name|3) 30007 am_resume_activity (User|1|5),(Token|1|5),(Task ID|1|5),(Component Name|3) 30008 am_anr (User|1|5),(pid|1|5),(Package Name|3),(Flags|1|5),(reason|3) //ANR 30009 am_activity_launch_time (User|1|5),(Token|1|5),(Component Name|3),(time|2|3) 30010 am_proc_bound (User|1|5),(PID|1|5),(Process Name|3) 30011 am_proc_died (User|1|5),(PID|1|5),(Process Name|3),(OomAdj|1|5),(ProcState|1|5) 30012 am_failed_to_pause (User|1|5),(Token|1|5),(Wanting to pause|3),(Currently pausing|3) 30013 am_pause_activity (User|1|5),(Token|1|5),(Component Name|3),(User Leaving|3) 30014 am_proc_start (User|1|5),(PID|1|5),(UID|1|5),(Process Name|3),(Type|3),(Component|3) 30015 am_proc_bad (User|1|5),(UID|1|5),(Process Name|3) 30016 am_proc_good (User|1|5),(UID|1|5),(Process Name|3) 30017 am_low_memory (Num Processes|1|1) 30018 am_destroy_activity (User|1|5),(Token|1|5),(Task ID|1|5),(Component Name|3),(Reason|3) 30019 am_relaunch_resume_activity (User|1|5),(Token|1|5),(Task ID|1|5),(Component Name|3) 30020 am_relaunch_activity (User|1|5),(Token|1|5),(Task ID|1|5),(Component Name|3) 30021 am_on_paused_called (User|1|5),(Component Name|3),(Reason|3) 30022 am_on_resume_called (User|1|5),(Component Name|3),(Reason|3) 30023 am_kill (User|1|5),(PID|1|5),(Process Name|3),(OomAdj|1|5),(Reason|3) //殺進程 30024 am_broadcast_discard_filter (User|1|5),(Broadcast|1|5),(Action|3),(Receiver Number|1|1),(BroadcastFilter|1|5) 30025 am_broadcast_discard_app (User|1|5),(Broadcast|1|5),(Action|3),(Receiver Number|1|1),(App|3) 30030 am_create_service (User|1|5),(Service Record|1|5),(Name|3),(UID|1|5),(PID|1|5) 30031 am_destroy_service (User|1|5),(Service Record|1|5),(PID|1|5) 30032 am_process_crashed_too_much (User|1|5),(Name|3),(PID|1|5) 30033 am_drop_process (PID|1|5) 30034 am_service_crashed_too_much (User|1|5),(Crash Count|1|1),(Component Name|3),(PID|1|5) 30035 am_schedule_service_restart (User|1|5),(Component Name|3),(Time|2|3) 30036 am_provider_lost_process (User|1|5),(Package Name|3),(UID|1|5),(Name|3) 30037 am_process_start_timeout (User|1|5),(PID|1|5),(UID|1|5),(Process Name|3) 30039 am_crash (User|1|5),(PID|1|5),(Process Name|3),(Flags|1|5),(Exception|3),(Message|3),(File|3),(Line|1|5) 30040 am_wtf (User|1|5),(PID|1|5),(Process Name|3),(Flags|1|5),(Tag|3),(Message|3) 30041 am_switch_user (id|1|5) 30042 am_activity_fully_drawn_time (User|1|5),(Token|1|5),(Component Name|3),(time|2|3) 30043 am_set_resumed_activity (User|1|5),(Component Name|3),(Reason|3) 30044 am_focused_stack (User|1|5),(Focused Stack Id|1|5),(Last Focused Stack Id|1|5),(Reason|3) 30045 am_pre_boot (User|1|5),(Package|3) 30046 am_meminfo (Cached|2|2),(Free|2|2),(Zram|2|2),(Kernel|2|2),(Native|2|2) 30047 am_pss (Pid|1|5),(UID|1|5),(Process Name|3),(Pss|2|2),(Uss|2|2),(SwapPss|2|2),(Rss|2|2),(StatType|1|5),(ProcState|1|5),(TimeToCollect|2|2) //進程 30048 am_stop_activity (User|1|5),(Token|1|5),(Component Name|3) 30049 am_on_stop_called (User|1|5),(Component Name|3),(Reason|3) 30050 am_mem_factor (Current|1|5),(Previous|1|5) 30051 am_user_state_changed (id|1|5),(state|1|5) 30052 am_uid_running (UID|1|5) 30053 am_uid_stopped (UID|1|5) 30054 am_uid_active (UID|1|5) 30055 am_uid_idle (UID|1|5) 30056 am_stop_idle_service (UID|1|5),(Component Name|3) 30057 am_on_create_called (User|1|5),(Component Name|3),(Reason|3) 30058 am_on_restart_called (User|1|5),(Component Name|3),(Reason|3) 30059 am_on_start_called (User|1|5),(Component Name|3),(Reason|3) 30060 am_on_destroy_called (User|1|5),(Component Name|3),(Reason|3) 30061 am_remove_task (Task ID|1|5), (Stack ID|1|5) 30062 am_on_activity_result_called (User|1|5),(Component Name|3),(Reason|3)
從相應的Event的定義的TagName以及后面的參數的說明，我們可以拿到在我們分析問題的過程中需要的信息。
(2) WindowManager相關：
31000 wm_no_surface_memory (Window|3),(PID|1|5),(Operation|3) 31001 wm_task_created (TaskId|1|5),(StackId|1|5) 31002 wm_task_moved (TaskId|1|5),(ToTop|1),(Index|1) 31003 wm_task_removed (TaskId|1|5),(Reason|3) 31004 wm_stack_created (StackId|1|5) 31005 wm_home_stack_moved (ToTop|1) 31006 wm_stack_removed (StackId|1|5) 31007 wm_boot_animation_done (time|2|3)
(3) Power相關：
2722 battery_level (level|1|6),(voltage|1|1),(temperature|1|1) 2723 battery_status (status|1|5),(health|1|5),(present|1|5),(plugged|1|5),(technology|3) 可以從這里看出什么時刻插入了充電器 2724 power_sleep_requested (wakeLocksCleared|1|1) 2725 power_screen_broadcast_send (wakelockCount|1|1) 2726 power_screen_broadcast_done (on|1|5),(broadcastDuration|2|3),(wakelockCount|1|1) 2727 power_screen_broadcast_stop (which|1|5),(wakelockCount|1|1) 2728 power_screen_state (offOrOn|1|5),(becauseOfUser|1|5),(totalTouchDownTime|2|3),(touchCycles|1|1),(latency|1|3) 2729 power_partial_wake_state (releasedorAcquired|1|5),(tag|3) 2730 battery_discharge (duration|2|3),(minLevel|1|6),(maxLevel|1|6) 2731 power_soft_sleep_requested (savedwaketimems|2)
(3) Notification相關：
27500 notification_panel_revealed (items|1) 27501 notification_panel_hidden 27510 notification_visibility_changed (newlyVisibleKeys|3),(noLongerVisibleKeys|3) 27511 notification_expansion (key|3),(user_action|1),(expanded|1),(lifespan|1),(freshness|1),(exposure|1) 27520 notification_clicked (key|3),(lifespan|1),(freshness|1),(exposure|1),(rank|1),(count|1) 27521 notification_action_clicked (key|3),(action_index|1),(lifespan|1),(freshness|1),(exposure|1),(rank|1),(count|1) 27530 notification_canceled (key|3),(reason|1),(lifespan|1),(freshness|1),(exposure|1),(rank|1),(count|1),(listener|3) 27531 notification_visibility (key|3),(visibile|1),(lifespan|1),(freshness|1),(exposure|1),(rank|1) 27532 notification_alert (key|3),(buzz|1),(beep|1),(blink|1) 27533 notification_autogrouped (key|3)
二、補充
1. event log 在framework層常常使用，通過類似EventLog.writeEvent()寫log，這種log被保存在/system/etc/event-log-tags，如果要看這種log，通過類似# logcat -b events -v threadtime 這種方式打印出來，輸出的格式類似於下面：
02-18 12:29:22.625 451 467 I am_create_task: [0,116] 02-18 12:29:22.625 451 467 I am_create_activity: [0,114895309,116,com.xd.ro.roapk/com.xindong.RODevelop.UnitySavePicActivity,android.intent.action.MAIN,NULL,NULL,270532608] 02-18 12:29:22.626 451 467 I wm_task_created: [116,1]
它的格式就是: timestamp PID TID log-level log-tag tag-values
每個log-tag都能在framework下的源代碼中找到，如上面的am_create_task，它的tag是在frameworks/base/services/core/java/com/android/server/am/EventLogTags.logtags定義的。某種程度上說，要檢查event log，必須去找這些EventLogTags.logtags，才能清楚知道是啥意思。
EventLogTags.logtags 在frameworks下的多個目錄下都有，不只是1個文件，編譯到手機中就匯成一個文件了。
三、EventLog實戰
1. am_proc_start的
定義： 30014 am_proc_start (User|1|5),(PID|1|5),(UID|1|5),(Process Name|3),(Type|3),(Component|3) EventLog： I am_proc_start: [0,6533,10131,com.jingdong.app.mall:WatchDogService,service,com.jingdong.app.mall/com.jingdong.common.watchdog.WatchDogService] 含義： 啟動一個進程，UserId=0,PID=6533,UID=10131,ProcessName=com.jingdong.app.mall:WatchDogService,Type=service,Component=com.jingdong.app.mall/com.jingdong.common.watchdog.WatchDogService
參考：Android開發中EventLog分析: https://www.jianshu.com/p/dc9e75bcf539