AIX > Tips & Techniques > Systems Management

AHAFS Enables AIX Event Monitoring Without Writing Code

AHAFS Enables AIX Event Monitoring Without Writing Code

Starting with AIX 6100-06 and 7100-00, IBM introduced the AIX Event Infrastructure for monitoring pre-defined and user-defined system events—such as modification of a file’s content, utilization of a filesystem exceeding a user-defined threshold, death of a process or a change in the value of a kernel tunable parameter—without the high overhead of polling. This infrastructure can automatically notify registered users or processes instantly about the occurrences of such events, with information useful for maintaining and improving the health and security of the running AIX instance. The information provided in the notification includes the what, when, who and where the event happened, and it can include the whole function call-chain that triggered the event.

At the core of the AIX Event Infrastructure is a pseudo-filesystem: Autonomic Health Advisor FileSystem (AHAFS), which is implemented as a kernel extension. AHAFS mainly acts as a mediator to take the requests of event registration, monitoring and unregistering from the processes interested in monitoring for events. It forwards the requests to the corresponding event producers (code responsible for triggering the occurrence of an event) in the kernel space, processes the callback functions when the event occurs, and notifies the registered users or processes with useful information.

The key features of this infrastructure are:

  • It requires no new API for monitoring events. The monitoring applications just need to use the existing filesystem interfaces (e.g. open(), write(), select(), read(), close()) in AIX, which are supported by many programming languages like C, C++, Java, Perl, etc., to register/monitor/unregister the events.
  • It provides detailed information—such as stack trace, program name, time stamp, user and process information—about the occurrence of an event.
  • The same event can be monitored by many users or processes, each with a different threshold.
  • Different levels of information can be extracted by the different users or processes upon the occurrence of an event.
  • Any component or subcomponent in the kernel space, including kernel extensions and device drivers, can register its own event producers to AHAFS to enable the monitoring of its events. For example, it can monitor events on files, filesystems, kernel tunables on CPU or memory, and even networking events.

Joefon Jann is a Distinguished Engineer at the IBM Watson Research Center in New York.

Niteesh Dubey is a Senior Engineer at the IBM Watson Research Center in New York.


comments powered by Disqus

Advertisement

Advertisement

2017 Solutions Edition

A Comprehensive Online Buyer's Guide to Solutions, Services and Education.

IBM Systems Magazine Subscribe Box Read Now Link Subscribe Now Link iPad App Google Play Store
AIX News Sign Up Today! Past News Letters