This is entirely from IBM's docs. Some is cut and paste, and some is abbreviated or reworded slightly. No credit is taken for this material. All links herein go back to the source documentation which will have more details.
In the AIX Event Infrastructure
, an event is defined as any change of a state or a value that can be detected by the kernel or a kernel extension at the time the change occurs. The events that can be monitored are represented as files in a pseudo file system.
The only steps necessary to set up the AIX Event Infrastructure are:
- Install the bos.ahafs fileset.
- Create the directory for the desired mount point.
- mkdir /aha
- mount -v ahafs /aha /aha
Mounting an AIX Event Infrastructure file system will automatically load the kernel extension and create all monitor factories. Only one instance of an AIX Event Infrastructure file system may be mounted at a time. An AIX Event Infrastructure file system may be mounted on any regular directory, but it is suggested that users use /aha.
Once mounted, the ahafs will contain these structures:evProds.list
"contains" the names of all currently defined event producers.*.monFactory
directories are automatically created for each event producer.Subdirectories
may be used for logical separation within a factory.*.mon
files within the factory, potentially created on open by the consumer, represent the events that can be monitored. For example, the file /aha/fs/modFile.monFactory/etc/password.
mon is used to monitor the modifications to the /etc/passwd file.
The AIX Event Infrastructure will translate text input written to .mon
files into specifications on how the user wants to be notified of event occurrences. Once a user has issued a select() or a blocking read() call to signify the beginning of their monitoring, the AIX Event Infrastructure will notify the corresponding event producer to start monitoring the specified event.NOTE:
The AIX® Event Infrastructure tracks monitoring per process
, and is not thread safe. Processes should not use multiple threads to monitor the same event. Instead, spawn a separate process should the same event need to be monitored in multiple ways.
An example output for a state change event producer who has specified that a stack trace should be taken:
An example for a threshold value event:
Due to the asynchronous nature of process notification, the current value returned may be stale by the time a process reads the monitor file. Users are notified when the threshold is first met or exceeded, but other operations which may alter the values being monitored will not be blocked.
All directories in the AIX® Event Infrastructure file system have an access mode of 1777 and all files have access mode of 0666. These modes cannot be changed, but the ownership of files and directories may be changed. Access control for monitoring events is done at the event producer level. Creation / modification times are not maintained and are always returned as the current time when issuing stat () on a file object within the pseudo file system. Any attempt to modify these times will return an error.
More details on monitoring events is available in the publib section on AIX 6.1 System Information on AHAFS
See Predefined Event Producers
for info on what producers come with AIX 6.1.
Finally, PowerHA (aka HA/CMP) has producers which can show events from other nodes in your active cluster. See Pre-Defined Event Producers for a Cluster-Aware AIX Instance
to see what's available in an HA/CMP aka PowerHA environment.