modFile
The modFile event producer monitors for modifications to the contents of a file.
- Overview
The modFile event producer resides under the fs directory and monitors for modifications to a file. The following vnode operations are monitored: vnop_rdwr(), vnop_map_lloff(), vnop_remove(), vnop_ftrunc(), vnop_fclear() and vnop_rename(). Modifications which do not go through the LFS layer cannot be monitored (that is writes to mapped files).
Files may not be monitored if:
- They are in a remote file system.
- They are in file system of type ahafs, procfs or namefs.
- They are a symbolic link.
- They reside under a directory which ends with an AIX® Event Infrastructure extension (.mon, .list, .monFactory).
- Monitor files with a full path name larger than MAXPATHLEN in the AIX Event Infrastructure pseudo file system cannot be monitored.
- Capabilities
AHAFS_THRESHOLD_STATE AHAFS_STKTRACE_AVAILABLE AHAFS_REMOTE_EVENT_ENABLED- Return codes
The modFile event producer uses return codes which are defined in <sys/ahafs_evProds.h>.
These return codes are used to indicate how the contents of the monitored directory were modified:
- AHAFS_MODFILE_WRITE
- The monitored file was written to.
- AHAFS_MODFILE_UNMOUNT
- The file system containing the monitored file was unmounted. This is an unavailable event.
- AHAFS_MODFILE_MAP
- A process has mapped a portion of the monitored file for writing.
- AHAFS_MODFILE_REMOVE
- The monitored file has been removed. This is an unavailable event.
- AHAFS_MODFILE_RENAME
- The monitored file has been renamed. This is an unavailable event.
- AHAFS_MODFILE_FCLEAR
- A process has issued an fclear for the monitored file.
- AHAFS_MODFILE_FTRUNC
- A process has issued an ftrunc for the monitored file.
- AHAFS_MODFILE_OVERMOUNT
- The monitored file has been over mounted.
- Event producer message
This event producer does not pass any messages as part of its event data.
- Acceptable monitor files
To monitor for file modifications, a monitor file with the same path as the file you wish to monitor should be created under the modFile.monFactory directory. For example, to monitor /etc/passwd, the monitor file /aha/fs/modFile.monFactory/etc/passwd.mon would be used.
- Example event data
The following event data was generated from a process writing to a monitored file. This is the output seen with an INFO_LVL of 3:
BEGIN_EVENT_INFO TIME_tvsec=1271703118 TIME_tvnsec=409201093 SEQUENCE_NUM=0 PID=5701678 UID=0 UID_LOGIN=0 GID=0 PROG_NAME=cat RC_FROM_EVPROD=1000 STACK_TRACE aha_cbfn_wrapper+30 ahafs_evprods+510 aha_vn_write+154 vnop_rdwr+7E8 vno_rw+B4 rwuio+100 rdwr+188 kewrite+104 .svc_instr write+1A4 _xwrite+6C _xflsbuf+A8 __flsbuf+C0 copyopt+2E8 scat+22C main+11C __start+68 END_EVENT_INFO