5.2 AIXHWLog

Use this Knowledge Script to monitor the hardware error log on computers running the AIX operating system. This script uses the AIX errpt command to gather hardware records, parses those records, and raises an event when a record matches the filter and regular expression criteria you specify.

This script is intended to monitor AIX hardware error logs and uses the errpt -d H option internally to return only hardware records.

NOTE:This Knowledge Script is available as soon as you install it. It does not require that you run the Discovery_HardwareUNIX Knowledge Script to discover resources.

5.2.1 Filtering

This Knowledge Script provides the following filters through the AIX errpt command:

An error label filter to return records whose label matches a specified error label
A start time filter to return records whose timestamp is on or after the start time
An end time filter to return records whose timestamp is on or before the end time

In addition to filters provided through errpt, this script provides additional filters on the records errpt returns:

An include filter to return records that match a specified regular expression
An exclude filter to return records that do not match any specified regular expression

This script filters records returned by errpt using the include filter first, discarding those records that do not match the filter. This script filters the remaining records using the exclude filter, discarding those records matched by the filter.

By default, the include filter is set to the regular expression .+ to include all records returned from errpt. An empty include filter discards all records.

By default, the exclude filter is empty. An empty exclude filter does not exclude any records.

As with all include and exclude filter pairs, it is important to recognize and avoid include and exclude combinations that discard all records and prevent this script from raising events for important AIX hardware status changes. In many instances it is sufficient to set one filter or the other, include or exclude, to reduce the number of incoming records to those necessary for your AIX hardware monitoring requirements.

5.2.2 Resource Objects

Any computer running AIX

5.2.3 Default Schedule

The default interval for this script is Every 30 minutes.

5.2.4 Setting Parameter Values

Set the following parameters as needed:

Description	How to Set It
Text match filters
Regular expression specifying the include filter (comma-separated)	Type a list of regular expressions, comma-separated, to match and include when parsing hardware records. The default is .+ to include all hardware records received from errpt. WARNING:Do not clear this parameter. An empty include filter discards all hardware records. NOTE:All regular expressions are Perl regular expressions. Regular expression matching is case-insensitive.
Regular expression specifying the exclude filter (comma-separated)	Type a list of regular expressions, comma-separated, to match and exclude when parsing hardware records. The default is none, so no records are excluded. NOTE:All regular expressions are Perl regular expressions. Regular expression matching is case-insensitive.
Label match strings
Comma separated error labels	Type a list of error labels, comma-separated, to match when parsing hardware records. The default is PHXENT_DOWN,LVM_IO_FAIL,CPU_FAIL_PREDICTED,DISK_ERR2,IDE_DISK_ERR3,LVM_SA_PVMISS This field accepts comma-separated regular expressions. This script expands the expressions to match the list of system labels. This script gets the list of system labels from the command: errpt -t -d H For example, if you type disk in this field, this Knowledge Script matches all system labels containing disk as a substring. If none of the label strings in this field matches any system label, this field is treated as empty and the entire errpt output is considered. For example, if you type my_label in this field and no system label matches it, all system labels are valid and nothing is filtered. NOTE:Events raised by this script list the expanded labels used to filter the errpt output in the event detailed message.
Treat as exclusion label	Select Yes to treat the comma-separated list of error labels as an exclusion list rather than an inclusion list when parsing hardware records. The default is no.
Time settings
Start Time (ddmmyyhhmm)	Type the time and date as day, month, year, hour, minute, using the format ddmmyyhhmm, to identify the first timestamp to include when parsing hardware records. There is no default, so errpt parses records posted since: this script’s start time, if this is the first run this script’s last run time, if this is the second or a subsequent run If Start Time precedes the first timestamp in the log, errpt parses the entire log. If the last timestamp in the log precedes Start Time, errpt only parses hardware records added on or after Start Time. NOTE: This script will not save the current time while it precedes Start Time. The script will run normally, but will not store internal states and will not raise events until Start Time arrives. This parameter uses time format ddmmyyhhmm. The AIX errpt command uses format mmddhhmmyy.
End Time (ddmmyyhhmm)	Type the time and date as day, month, year, hour, minute, using the format ddmmyyhhmm, to identify the last timestamp to include when parsing hardware records. There is no default, indicating errpt should parse to the end of the log. If End Time precedes the first timestamp in the log, errpt will not parse any entries from the log. If End Time precedes the last timestamp in the log, errpt will only parse hardware records added on or before End Time. When the current time passes End Time, this script raises an information event. This script continues to execute but will not raise any additional events while End Time lies in the past. NOTE:This field uses time format ddmmyyhhmm. The AIX errpt command uses format mmddhhmmyy.
Override scan from beginning of the log?	Select to Yes to override the start and/or end times and parse the hardware error log from the beginning of the file. The default is no.
Optional errpt log file location	Type the path that represents an alternate location for the hardware error log. There is no default. NOTE: The log file you specify will be used by errpt and should be in a format errpt can read and should not be a plain text file. When no optional hardware error file is specified, errpt uses the file named in the AIX error log configuration database.
Event Settings
Raise event if hardware error occurred?	Select to Yes to raise an event if a hardware error occurred. The default is Yes.
Event severity	Specify the event severity level, from 1 to 40, to indicate the importance of a hardware error event. The default is 5.
Raise event if AppManager fails to get metrics?	Select to Yes to raise an event if AppManager cannot collect any information about the hardware error log. The default is yes.
Event severity	Specify the event severity, from 1 to 40, to indicate the importance of an event when AppManager cannot collect any information about the hardware error log. The default is 5.
Event severity when job fails	Specify the event severity, from 1 to 40, to indicate the importance of an event when this job fails. The default is 5.
Informative event severity	Specify the event severity, from 1 to 40, to indicate the importance of an informative event. The default is 25.
Aggregate event per iteration?	Select to Yes to aggregate multiple events during an iteration into one event per matched regular expression. The default is unselected. When you choose to aggregate events, this Knowledge Script subsequently raises events with the following short message: Errors in errpt log recorded. If this script creates two of these events in an interval, it collapses them by default, replacing the content of the first event with the content of the second one. To prevent this replacement, NetIQ recommends you uncheck Collapse duplicate events into a single event on the Advanced tab when you aggregate events.
Enable debuggin?	Select Yes to enable debugging or this Knowledge Script. The default is unselected.

5.2.5 Understanding Start Time and End Time

The Start Time and End Time control the range of timestamps this Knowledge Script receives from the AIX errpt command. With parameter Override scan from beginning of the log, Start Time and End Time determine a number of parsing actions this Knowledge Script can take.

Start and End Time in the AIX errpt Command

errpt accepts the following start and stop options:

-s StartDate: Return all records posted on and after StartDate.
-e EndDate: Return all records posted prior to and including EndDate.

Knowledge Script Restarts and Data Failures

When this Knowledge Script restarts, either explicitly as part of an agent restart or because a parameter changes during execution, this script discards old time states and re-reads all script parameters.

If this Knowledge Script fails to get data during a run, it will retain and use the same base time for the next run.

Start Time, End Time, and Scan from Top of Log

The following table describes the permutations of Start Time, End Time, and Override scan from beginning of log. The character “n” indicates the parameter value is not set, while “y” indicates a time value is set or the override is set to Yes.

NOTE:Where the term “Epoch time” is used, it is equivalent to 00:00:00 UTC on Thursday, January 1, 1970.

Start Time	Stop Time	Beginning of Log	Knowledge Script Action
n	n	n	During its first run, this Knowledge Script uses the current time. In subsequent runs, it raises events for hardware records posted since the previous run.
n	y	n	During its first run, this Knowledge Script uses the current time. In subsequent runs, it raises events for hardware records posted since the previous run and before Stop Time. In the first run after Stop Time, this script raises an information event indicating Stop Time has elapsed. It continues to run as scheduled but does not raise events while Stop Time is in the past. If Stop Time precedes the first run time, this script raises an event for hardware records posted from Start Time to Stop Time and raises an information event indicating Stop Time has elapsed.
y	n	n	During its first run, this Knowledge Script raises events for hardware records posted between Start Time and the current time. In subsequent runs, this script raises events for hardware records posted since the previous run.
y	y	n	During its first run, this Knowledge Script raises events for hardware records posted between Start Time and the current time. In subsequent runs, this script raises events for hardware records posted since the previous run and before Stop Time. Reporting does not begin until on or after Start Time. This script will run as scheduled before Start Time, but will not receive hardware records or raise events until on or after Start Time. In the first run after Stop Time, this script raises an information event indicating Stop Time has elapsed. This script continues to run as scheduled but does not raise events while Stop Time is in the past.
n/y	n	y	During its first run, this Knowledge Script uses the Epoch time and does not raise events. In subsequent runs, it raises events for hardware records posted since the previous run.
n/y	y	y	During its first run, this Knowledge Script uses the Epoch time and does not raise events. In subsequent runs, it raises events for hardware records posted since the last run and before Stop Time. In the first run after Stop Time, this script raises an information event indicating Stop Time has elapsed. It continues to run as scheduled but does not raise events while Stop Time is in the past. If Stop Time precedes the first run time, this script raises an event for hardware records posted from the Epoch time to Stop Time and raises an information event indicating Stop Time has elapsed.