Determining how long device has been in defined state

jwholey · #1 02-04-2013

All,

Hoping you can help. I'm wondering how I can determine how long a device (network interface) has been in a defined state. Know there's a way, just can't figure it out.

Thanks in advance!

zaxxon · #2 02-04-2013

Afaik something like that is not being logged right out of the box. You could check the ODM, if there is any kind of timestamp somewhere associated with the appropriate interface (have no AIX to check at the moment), but I quite doubt that. I also doubt it is written to the Error Report, but you can try out that very easy. Error Report is bound to a buffer size and it`s entries will be overwritten, if too many messages go in there.

If you have Auditing (Accounting and Auditing on AIX 5L) set up you could be lucky to find some traces of any shell input. If not, you could set this up if things like this are in your interesst.

You could also think about to use something to track config changes like SPM.
There was also an AIX native tool, but I do not remember it´s name. Xray was using it - I will drop him a PM, to help me recall it´s name

If the user had to use sudo to issue the command, you might be lucky with the sudo logs.

If it was done via smitty, check smitty.log.

dukessd · #3 02-04-2013

You could use alog to check the boot log file but on most systems I see they wrap at a couple of boots, or less, so it may be lost.

Just like the errlog file these are way too small by default.

The errlog is by default 1MB of disk space on a system with 4, 16, 64 GB ram, this is silly, turn it up people if you want to have any idea of what happened!

I've seen systems fill the errlog in less than a minute!

jwholey · #4 02-05-2013

Thanks for the updates... appreciated. One of the SA's who supports my app has advised me that a few network interfaces went into defined state over a year ago. I'm not suggesting something nefarious is going on, I would simply like to know how he determined that.

dukessd · #5 02-05-2013

Um, did you think of asking them?
Please post back if it is anything other than "because I noticed it in the lsdev output" ;0)

MichaelFelt · #6 02-11-2013

Quote:

Originally Posted by jwholey

Thanks for the updates... appreciated. One of the SA's who supports my app has advised me that a few network interfaces went into defined state over a year ago. I'm not suggesting something nefarious is going on, I would simply like to know how he determined that.

Basically, you should also ask - went into Defined state from what.

FYI (although you may know this already) - Defined means, simply, that there is an entry in the CuDv (Customized Device) ODM file. Available means there is "also" a system driver/kernel extension that is associated with the device.

An Available device can be made Defined by using the command
rmdev -l devName
And made available using the command
mkdev -l devName

AND: this needs to all be happening via the ODM

Code:

root@x107:[/export/lpp/7102/installp/ppc]lsdev -C | grep et
en0        Available       Standard Ethernet Network Interface
ent0       Available       Virtual I/O Ethernet Adapter (l-lan)
et0        Defined         IEEE 802.3 Ethernet Network Interface

Thread Tools	Search this Thread
Show Printable Version Email this Page Subscribe to this Thread	Search this Thread: Advanced Search
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

More UNIX and Linux Forum Topics You Might Find Helpful
Thread	Thread Starter	Forum	Replies	Last Post
Device Available / Define state	manoj.solaris	AIX	2	05-18-2012 02:12 AM
Hitting with custom port in CLOSE_WAIT state for long time in solaris 10	mgmk.84	UNIX for Dummies Questions & Answers	0	04-28-2009 04:34 AM