inetsock

Edit online

The inetsock event producer monitors Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) socket operations.

Overview
The inetsock event producer is placed under the net directory and monitors socket operations.
The following socket operations are monitored for TCP:
  • Creating a socket
  • Binding a port or address to the socket
  • Listening on the socket
  • Accepting and establishing a connection on the socket
  • Connecting to a socket
  • Disconnecting from a socket
  • Closing the socket
The following socket operations are monitored for UDP:
  • Creating a socket
  • Binding a port or address to the socket
  • Closing the socket
Capabilities
AHAFS_THRESHOLD_STATE
AHAFS_CALLBACK_INTRCNTX
AHAFS_REMOTE_EVENT_ENABLED
Event producer message
This event producer passes information that is available in the protocol control block and socket as a part of its event data.

The following data is passed for the TCP socket operations:

Socket operation Data
PRU_ATTACH Common information:
  • PROG_NAME
  • SO_FAMILY
  • SO_PID
  • SO_PROTO
  • SO_TYPE
  • SO_UID
PRU_BIND Common information plus the following items:
  • SO_LADDR
  • SO_LPORT
PRU_LISTEN Common information plus the following items:
  • SO_LADDR
  • SO_LPORT
PRU_ACCEPT Common information plus the following items:
  • SO_FADDR
  • SO_FPORT
  • SO_LADDR
  • SO_LPORT
PRU_CONNECT Common information plus the following items:
  • SO_FADDR
  • SO_FPORT
  • SO_LADDR
  • SO_LPORT
PRU_DISCONNECT Common information plus the following items:
  • SO_FADDR
  • SO_FPORT
  • SO_LADDR
  • SO_LPORT
PRU_DETACH, PRU_ABORT Common information plus the following items:
  • SO_LADDR
  • SO_LPORT
  • SO_FADDR
  • SO_FPORT

The following data is passed for the UDP socket operations:

Socket operation Data
PRU_ATTACH Common information:
  • PROG_NAME
  • SO_FAMILY
  • SO_PID
  • SO_PROTO
  • SO_TYPE
  • SO_UID
PRU_BIND, PRU_DYNBIND Common information plus the following items:
  • SO_LADDR
  • SO_LPORT
PRU_DETACH, PRU_ABORT Common information plus the following items:
  • SO_LADDR
  • SO_LPORT
Acceptable monitor files
To monitor the socket operations, a monitor file that has the name of the socket operation that you want to monitor must be created in the inetsock.monFactory directory. For example, to monitor the TCP socket creation, the /aha/net/inetsock.monFactory/streamCreate.mon monitor file is used. Similarly, to monitor UDP socket creation, the /aha/net/inetsock.monFactory/dgramCreate.mon monitor file is used.
The following files are used for all the Autonomic Health Advisor File System (AHAFS)-monitorable TCP socket operations:
  • /aha/net/inetsock.monFactory/streamCreate.mon
  • /aha/net/inetsock.monFactory/streamBind.mon
  • /aha/net/inetsock.monFactory/streamListen.mon
  • /aha/net/inetsock.monFactory/streamAccept.mon
  • /aha/net/inetsock.monFactory/streamConnect.mon
  • /aha/net/inetsock.monFactory/streamDisconnect.mon
  • /aha/net/inetsock.monFactory/streamClose.mon
The following files are used for all the AHAFS-monitorable UDP socket operations:
  • /aha/net/inetsock.monFactory/dgramCreate.mon
  • /aha/net/inetsock.monFactory/dgramBind.mon
  • /aha/net/inetsock.monFactory/dgramClose.mon
Example event data
The following event data was generated from a process when a socket is created. The following example is the output that is displayed with an output level of 2 (INFO_LVL=2):
AHAFS event: /aha/net/inetsock.monFactory/streamCreate.mon
---------------------------------------------------

BEGIN_EVENT_INFO
Time          : Mon Jan 23 23:04:06 2012
Sequence Num: 1
RC_FROM_EVPROD=0
BEGIN_EVPROD_INFO
PROG_NAME=xmtopas
SO_FAMILY=2
SO_TYPE=1
SO_PROTO=6
SO_UID=0
SO_PID=5243048
END_EVPROD_INFO
END_EVENT_INFO