Edit: Still an interesting concept.
Originally posted August 25, 2015 on AIXchange
On Twitter, Chris Gibson linked to this interesting post from Andrey Klyachin:
A colleague asked me, if there is an interface in AIX like inotify in Linux. He has some problem on one of his AIX boxes and wanted to monitor new files in a directory. Of course there is such interface since AIX 6.1 TL6 or AIX 7.1 – it is AHAFS. Not very well known AIX feature, used primarily by new PowerHA 7.1, but not by admins.
If you want to know more about the feature, I would suggest you first to read the IBM documentation. My example is just small practical example how to use the technology, not a manual about it.
The IBM documentation to which Andrey refers brings you to the Introduction to the AIX Event Infrastructure:
The AIX Event Infrastructure is an event monitoring framework for monitoring predefined and user-defined events.
In the AIX Event Infrastructure, an event is defined as any change of a state or a value that can be detected by the kernel or a kernel extension at the time the change occurs. The events that can be monitored are represented as files in a pseudo file system. Some advantages of the AIX Event infrastructure are:
- There is no need for constant polling. Users monitoring the events are notified when those events occur.
- Detailed information about an event (such as stack trace and user and process information) is provided to the user monitoring the event.
- Existing file system interfaces are used so that there is no need for a new application programming interface (API).
- Control is handed to the AIX Event Infrastructure at the exact time the event occurs.
Further in the documentation, we come to the infrastructure components:
The AIX Event Infrastructure is made up of the following four components:
- The kernel extension implementing the pseudo file system.
- The event consumers that consume the events.
- The event producers that produce events.
- The kernel component that serve as an interface between the kernel extension and the event producers.
From there, the doc covers setting up the Event infrastructure (which is basically installing bos.ahafs, creating the directory, and mounting it).
The high level view of how the AIX Event Infrastructure works says:
A consumer may monitor multiple events, and multiple consumers may monitor the same event. Each consumer may monitor value-based events with a different threshold value. To handle this, the AIX® Event Infrastructure kernel extension keeps a list of each consumer’s information including:
- Specified wait type (WAIT_IN_READ or WAIT_IN_SELECT)
- Level of information requested
- Threshold (s) for which to monitor (if monitoring a threshold value event)
- A buffer used to hold information about event occurrences.
Event information is stored per-process so that different processes monitoring the same event do not alter the event data. When a consumer process reads from a monitor file, it will only read its own copy of the event data.
Finally, the monitoring events section offers subsections on creating the monitor file, writing to the monitor file, reading event data, and more.
Relevant to the documentation is this typical workflow.
Now back to Andrey’s post. He’s written a perl script that notifies him when, for instance, someone changes the /root/smit.log file:
The procedure to create a new monitor is relatively simple. We have to create a new directory and to make a new .mon-file in the directory. In the file we write how much information do we need and some other flags. After that we read from the file, when a notification comes.
Let’s say we want to monitor file /root/smit.log and obtain a notification every time it is changed. We go to directory /aha/fs/modFile.monFactory – it is a standard directory for “File modification monitor”, and create a directory root there with mkdir command. Then we create smit.log.mon file in this directory and write CHANGED=YES;INFO_LVL=1 in this file. That’s it! After that the only thing we have to do is to wait, till some information comes.
And to think I found all this from a single tweet.