目录
前言
在 Android 开发中，EventLog是一种系统日志记录机制，用于记录 Android 系统的事件和信息。EventLog 记录的日志通常用于诊断和分析应用程序或系统的运行过程，以便开发人员了解应用程序的行为、性能和问题。
通过EventLog来分析Activity、Process、CPU、Window等相关信息。
一、EventLog使用
adb logcat -b events > event.log
获取到的信息基本上如：
06-14 13:36:12.677 481 481 I chatty : uid=1000(system) hwservicemanage expire 12 lines
06-14 13:36:36.090 1510 1998 I service_manager_stats: [100,106,73258]
06-14 13:36:37.086 481 481 I chatty : uid=1000(system) hwservicemanage expire 34 lines
06-14 13:36:41.273 1510 2017 I battery_level: [86,4364,254]
06-14 13:37:45.101 1510 2017 I battery_level: [87,4365,254]
06-14 13:37:46.532 481 481 I chatty : uid=1000(system) hwservicemanage expire 10 lines
06-14 13:37:52.349 1510 1998 I service_manager_stats: [100,97,76259]
06-14 13:37:53.220 1510 1651 I sysui_multi_action: [757,1696,758,6,759,2]
06-14 13:37:55.408 1510 21888 I dvm_lock_sample: [system_server,1,Binder:1510_20,5,PackageManagerService.java,5703,int com.android.server.pm.PackageManagerService.checkUidPermission(java.lang.String, int),-,5703,int com.android.server.pm.PackageManagerService.checkUidPermission(java.lang.String, int),1]
06-14 13:37:58.165 1510 2017 I battery_status: [5,2,1,2,Li-ion]
06-14 13:38:00.209 1510 1651 I power_sleep_requested: 0
06-14 13:38:00.271 1510 1651 I sysui_multi_action: [757,1696,758,6,759,0]
06-14 13:38:00.729 1510 1651 I am_pause_activity: [0,3267794,com.android.launcher3/.Launcher,userLeaving=false]
06-14 13:38:00.730 2401 2401 I am_on_top_resumed_lost_called: [0,com.android.launcher3.Launcher,topStateChangedWhenResumed]
06-14 13:38:00.734 2401 2401 I am_on_paused_called: [0,com.android.launcher3.Launcher,performPause]
06-14 13:38:00.746 1510 21888 I am_add_to_stopping: [0,3267794,com.android.launcher3/.Launcher,completePauseLocked]
06-14 13:38:00.759 1510 1613 I am_stop_activity: [0,3267794,com.android.launcher3/.Launcher]
06-14 13:38:00.760 1510 1613 I sysui_multi_action: [757,803,799,window_time_0,802,1801]
06-14 13:38:00.767 2401 2401 I am_on_stop_called: [0,com.android.launcher3.Launcher,sleeping]
06-14 13:38:01.018 1510 1621 I am_meminfo: [1092882432,124772352,5869568,348860416,583215104]
06-14 13:38:01.033 1510 1621 I am_pss : [26028,10162,com.example.hxplay,110610432,94441472,0,227602432,1,16,13]
06-14 13:38:01.045 1510 1610 I sysui_multi_action: [757,223,758,1]
06-14 13:38:01.046 1510 1621 I am_pss : [11871,10058,org.codeaurora.snapcam,41068544,27508736,0,164261888,1,17,10]
06-14 13:38:01.062 1510 1621 I am_pss : [31144,10115,com.qualcomm.qti.seccamservice:remote,8309760,4595712,106496,95776768,1,20,8]
06-14 13:38:01.073 2036 2036 I sysui_multi_action: [757,111,758,1]
06-14 13:38:01.073 1510 1621 I am_pss : [20962,10144,com.henry.basic,46262272,37482496,339968,153845760,1,17,10]
06-14 13:38:01.074 2036 2036 I sysui_multi_action: [757,126,758,1,759,126,927,0,928,1,1593,0]
06-14 13:38:01.075 2036 2036 I sysui_multi_action: [757,113,758,1,759,113,927,1,928,0,1593,0]
06-14 13:38:01.075 2036 2036 I sysui_multi_action: [757,118,758,1,759,118,927,2,928,0,1593,0]
06-14 13:38:01.076 2036 2036 I sysui_multi_action: [757,119,758,1,759,119,927,3,928,0,1593,0]
06-14 13:38:01.077 2036 2036 I sysui_multi_action: [757,123,758,1,759,123,927,4,928,0,1593,0]
06-14 13:38:01.077 2036 2036 I sysui_multi_action: [757,261,758,1,759,261,927,5,928,0,1593,0]
06-14 13:38:01.082 1510 1621 I am_pss : [1216,10160,com.android.audiotest,27436032,21733376,2049024,110301184,1,17,7]
06-14 13:38:01.095 1510 1621 I am_pss : [19949,10051,com.android.providers.calendar,7484416,5378048,0,86237184,1,20,6]
06-14 13:38:01.101 2036 2036 I sysui_multi_action: [757,196,758,2,759,0]
06-14 13:38:01.102 2036 2036 I sysui_status_bar_state: [1,0,0,0,0,1]
06-14 13:38:01.103 1510 1621 I am_pss : [32102,10146,com.han.devtool,12112896,9949184,0,88309760,1,20,7]
06-14 13:38:01.112 1510 3114 I sysui_multi_action: [757,127,758,1]
06-14 13:38:01.112 1510 3114 I sysui_multi_action: [757,804,799,note_load,801,3,802,1]
06-14 13:38:01.112 1510 1621 I am_pss : [32086,10161,org.schabi.newpipe,23066624,19763200,0,110485504,1,20,7]
06-14 13:38:01.112 1510 3114 I notification_panel_revealed: 3
......
二、EventLog语义规则分析
以进程启动为例
am_proc_start (User|1|5),(PID|1|5),(UID|1|5),(Process Name|3),(Type|3),(Component|3)
am_proc_start之后紧跟着的几个括号，其中括号里的内容格式如下：
(<name>|data type[|data unit])
(<名字>|数据类型[|数据单位])
其中(User|1|5) ==> 名字为User, 数据类型为1，数据单位为5，下面再来看看数据类型和数据单位：
每一种Tag由于功能和模块的不同，括号中的内容不同，但是都遵循以下规则：
（Name|type|unit）
- Name：表示这个字段的意义
- Type：表示这个字段的数据类型，取值为：
1: int
2: long
3: string
4: list
5: float
数据类型中int和string用得最多.
unit，取值为
1: Number of objects(对象个数)
2: Number of bytes(字节数)
3: Number of milliseconds(毫秒)
4: Number of allocations(分配个数)
5: Id
6: Percent(百分比)
s: Number of seconds (monotonic time)
例如：
am_proc_start (User|1|5),(PID|1|5),(UID|1|5),(Process Name|3),(Type|3),(Component|3)
am_proc_start: [0,9227,10002,com.android.browser,content provider,com.android.browser/.provider.BrowserProvider2]
含义如下：
进程启动: UserId=0, pid=9227, uid=10002, ProcessName=com.android.browser, 数据类型=ContentProvider, 组件=com.android.browser/.provider.BrowserProvider2
再来一个例子
am_proc_start (User|1|5),(PID|1|5),(UID|1|5),(Process Name|3),(Type|3),(Component|3)
am_proc_start: [0,6533,10131,com.jingdong.app.mall:WatchDogService,service,com.jingdong.app.mall/com.jingdong.common.watchdog.WatchDogService]
含义：
启动一个进程，UserId=0,PID=6533,UID=10131,ProcessName=com.jingdong.app.mall:WatchDogService,Type=service,Component=com.jingdong.app.mall/com.jingdong.common.watchdog.WatchDogService
Tips:
events_log中搜索“am_finish_activity”， 可以判断到底是APP自行结束的（正常结束，后面有app-request字样），还是被其他进程强制结束的(force-stop)
三、EventLog分类
3.1 ActivityManager
| TagName | 格式 | 功能 |
|---|---|---|
| am_finish_activity | User,Token,TaskID,ComponentName,Reason | |
| am_task_to_front | User,Task | |
| am_new_intent | User,Token,TaskID,ComponentName,Action,MIMEType,URI,Flags | |
| am_create_task | User ,Task ID | |
| am_create_activity | User ,Token ,TaskID ,ComponentName,Action,MIMEType,URI,Flags | |
| am_restart_activity | User ,Token ,TaskID,ComponentName | |
| am_resume_activity | User ,Token ,TaskID,ComponentName | |
| am_anr | User ,pid ,Package Name,Flags ,reason | ANR |
| am_activity_launch_time | User ,Token ,ComponentName,time | |
| am_proc_bound | User ,PID ,ProcessName | |
| am_proc_died | User ,PID ,ProcessName | |
| am_failed_to_pause | User ,Token ,Wanting to pause,Currently pausing | |
| am_pause_activity | User ,Token ,ComponentName | |
| am_proc_start | User ,PID ,UID ,ProcessName,Type,Component | |
| am_proc_bad | User ,UID ,ProcessName | |
| am_proc_good | User ,UID ,ProcessName | |
| am_low_memory | NumProcesses | Lru |
| am_destroy_activity | User ,Token ,TaskID,ComponentName,Reason | |
| am_relaunch_resume_activity | User ,Token ,TaskID,ComponentName | |
| am_relaunch_activity | User ,Token ,TaskID,ComponentName | |
| am_on_paused_called | User ,ComponentName | |
| am_on_resume_called | User ,ComponentName | |
| am_kill | User ,PID ,ProcessName,OomAdj ,Reason | 杀进程 |
| am_broadcast_discard_filter | User ,Broadcast ,Action,ReceiverNumber,BroadcastFilter | |
| am_broadcast_discard_app | User ,Broadcast ,Action,ReceiverNumber,App | |
| am_create_service | User ,ServiceRecord ,Name,UID ,PID | |
| am_destroy_service | User ,ServiceRecord ,PID | |
| am_process_crashed_too_much | User ,Name,PID | |
| am_drop_process | PID | |
| am_service_crashed_too_much | User ,Crash Count,ComponentName,PID | |
| am_schedule_service_restart | User ,ComponentName,Time | |
| am_provider_lost_process | User ,Package Name,UID ,Name | |
| am_process_start_timeout | User ,PID ,UID ,ProcessName | timeout |
| am_crash | User ,PID ,ProcessName,Flags ,Exception,Message,File,Line | Crash |
| am_wtf | User ,PID ,ProcessName,Flags ,Tag,Message | Wtf |
| am_switch_user | id | |
| am_activity_fully_drawn_time | User ,Token ,ComponentName,time | |
| am_focused_activity | User ,ComponentName | |
| am_home_stack_moved | User ,To Front ,Top Stack Id ,Focused Stack Id ,Reason | |
| am_pre_boot | User ,Package | |
| am_meminfo | Cached,Free,Zram,Kernel,Native | 内存 |
| am_pss | Pid, UID, ProcessName, Pss, Uss | 进程 |
可能使用的部分场景：
am_low_memory：位于AMS.killAllBackgroundProcesses或者AMS.appDiedLocked，记录当前Lru进程队列长度。
am_pss：位于AMS.recordPssSampleLocked(
am_meminfo：位于AMS.dumpApplicationMemoryUsage
am_proc_start:位于AMS.startProcessLocked，启动进程
am_proc_bound:位于AMS.attachApplicationLocked
am_kill: 位于ProcessRecord.kill，杀掉进程
am_anr: 位于AMS.appNotResponding
am_crash:位于AMS.handleApplicationCrashInner
am_wtf:位于AMS.handleApplicationWtf
am_activity_launch_time：位于ActivityRecord.reportLaunchTimeLocked()，后面两个参数分别是thisTime和 totalTime.
am_activity_fully_drawn_time:位于ActivityRecord.reportFullyDrawnLocked, 后面两个参数分别是thisTime和 totalTime
am_broadcast_discard_filter:位于BroadcastQueue.logBroadcastReceiverDiscardLocked
am_broadcast_discard_app:位于BroadcastQueue.logBroadcastReceiverDiscardLocked
Activity生命周期相关的方法:
am_on_resume_called: 位于AT.performResumeActivity
am_on_paused_called: 位于AT.performPauseActivity, performDestroyActivity
am_resume_activity: 位于AS.resumeTopActivityInnerLocked
am_pause_activity: 位于AS.startPausingLocked
am_finish_activity: 位于AS.finishActivityLocked, removeHistoryRecordsForAppLocked
am_destroy_activity: 位于AS.destroyActivityLocked
am_focused_activity: 位于AMS.setFocusedActivityLocked, clearFocusedActivity
am_restart_activity: 位于ASS.realStartActivityLocked
am_create_activity: 位于ASS.startActivityUncheckedLocked
am_new_intent: 位于ASS.startActivityUncheckedLocked
am_task_to_front: 位于AS.moveTaskToFrontLocked
3.2 WindowManager相关
wm_no_surface_memory (Window|3),(PID|1|5),(Operation|3)
wm_task_created (TaskId|1|5),(StackId|1|5)
wm_task_moved (TaskId|1|5),(ToTop|1),(Index|1)
wm_task_removed (TaskId|1|5),(Reason|3)
wm_stack_created (StackId|1|5)
wm_home_stack_moved (ToTop|1)
wm_stack_removed (StackId|1|5)
wm_boot_animation_done (time|2|3)
3.3 Power相关
| TagName | 格式 | 功能 |
|---|---|---|
| battery_level | level, voltage, temperature | |
| battery_status | status,health,present,plugged,technology | |
| battery_discharge | duration, minLevel,maxLevel | |
| power_sleep_requested | wakeLocksCleared | 唤醒锁数量 |
| power_screen_broadcast_send | wakelockCount | |
| power_screen_broadcast_done | on, broadcastDuration, wakelockCount | |
| power_screen_broadcast_stop | which,wakelockCount | 系统还没进入ready状态 |
| power_screen_state | offOrOn, becauseOfUser, totalTouchDownTime, touchCycles | |
| power_partial_wake_state | releasedorAcquired, tag |
部分含义：
battery_level: [19,3660,352] //剩余电量19%, 电池电压3.66v, 电池温度35.2℃
power_screen_state: [0,3,0,0] // 灭屏状态(0), 屏幕超时(3). 当然还有其他设备管理策略，其他理由都为用户行为
power_screen_state: [1,0,0,0] // 亮屏状态(1)
可能使用的部分场景：
power_sleep_requested: 位于PMS.goToSleepNoUpdateLocked
power_screen_state:位于Notifer.handleEarlyInteractiveChange, handleLateInteractiveChange
3.4 Notification相关
notification_panel_revealed (items|1)
notification_panel_hidden
notification_visibility_changed (newlyVisibleKeys|3),(noLongerVisibleKeys|3)
notification_expansion (key|3),(user_action|1),(expanded|1),(lifespan|1),(freshness|1),(exposure|1)
notification_clicked (key|3),(lifespan|1),(freshness|1),(exposure|1),(rank|1),(count|1)
notification_action_clicked (key|3),(action_index|1),(lifespan|1),(freshness|1),(exposure|1),(rank|1),(count|1)
notification_canceled (key|3),(reason|1),(lifespan|1),(freshness|1),(exposure|1),(rank|1),(count|1),(listener|3)
notification_visibility (key|3),(visibile|1),(lifespan|1),(freshness|1),(exposure|1),(rank|1)
notification_alert (key|3),(buzz|1),(beep|1),(blink|1)
notification_autogrouped (key|3)
