AIX System Monitoring (Standard) template

The AIX System Monitoring (Standard) template contains rules covering all of the AIX Monitors with the exception of the System Monitor.

Contains the following rules:

  • Hardware Errors - Errpt(Class=H)
  • Software Errors - Errpt(Class=S)

Contains the following rules:

  • Critical Subsystem (inetd) Does Not Exist - Subsystem Does Not Exist(inetd)
  • Critical Subsystem (inetd) is Inoperative - Subsystem is Inoperative(inetd)
  • Critical Subsystem (qdaemon) Does Not Exist - Subsystem Does Not Exist(qdaemon)
  • Critical Subsystem (qdaemon) is Inoperative - Subsystem is Inoperative(qdaemon)
  • Critical Subsystem (syslogd) Does Not Exist - Subsystem Does Not Exist(syslogd)
  • Critical Subsystem (syslogd) is Inoperative - Subsystem is Inoperative(inetd)

Contains the following rules:

  • Alert when Quorum is set to On When Disk Mirroring is Active (rootvg) Measure(Quorum) Trigger(=0)
  • Volume Group (rootvg) Does Not Exist - Volume Group rootvg Does Not Exist

Contains the following rules:

  • Check for Failed Logins - Script(/var/lib/halcyon/logfails.sh denied)
  • Check for Missing or Removed Disks - Script(lspv missing | removed)
  • Zombie process - Report on all - Script(ps-ec stat,pid | egrep “^Z” | awk ‘{print $2}’ ^[^$])
  • Zombie process count - Script(ps -eo stat,pid | egrep “^Z” | wc -l ^[^0])

Contains the following rules:

  • File (/etc/aixmibd.conf) Has Changed - File(/etc/aixmibd.conf) Trigger(Exists)
  • File (/etc/inetd.conf) Has Changed - File(/etc/inetd.conf) Trigger(Exists)
  • File (/etc/inittab) Has Changed - File(/etc/inittab) Trigger(Exists)
  • File (/etc/profile) Has Changed - File(/etc/profile) Trigger(Exists)
  • File (/etc/security/login.cfg) Has Changed - File(/etc/security/login.cfg) Trigger(Exists)
  • File (/etc/sendmail.cf) Has Changed - File(/etc/sendmail.cf) Trigger(Exists)
  • File (/var/spool/cron/crontabs/root) Has Changed - File(/var/spool/cron/crontabs/root) Trigger(Exists)

Contains the following rules:

  • Monitor for Failed Logins - LogFile(/var/lib/halcyon/failedlogins.log Expression(.*)
  • Monitor for New Entries in Cron Log - LogFile(/var/adm/cron/log) Expression(.*)

Contains the following rules:

  • Filesystem (/) Disk Space Used >=80% - Group(Filesystem) Volume(/) Type(UsedPercent) Trigger(>=80%)
  • Filesystem (/) Does Not Exist - Group(Filesystem) Volume(/) Trigger(Does Not Exist)
  • Filesystem (/) Inode Used >=90% - Group(Filesystem) Volume(/) Type(UUsedInodesPercent) Trigger(>=90%)
  • Filesystem (/home) Disk Space Used >=80% - Group(Filesystem) Volume(/home) Type(UsedPercent) Trigger(>=80%)
  • Filesystem (/home) Does Not Exist - Group(Filesystem) Volume(/home) Trigger(Does Not Exist)
  • Filesystem (/home) Inode Used >=90% - Group(Filesystem) Volume(/home) Type(UUsedInodesPercent) Trigger(>=90%)
  • Filesystem (/tmp) Disk Space Used >=80% - Group(Filesystem) Volume(/tmp) Type(UsedPercent) Trigger(>=80%)
  • Filesystem (/tmp) Does Not Exist - Group(Filesystem) Volume(/tmp) Trigger(Does Not Exist)
  • Filesystem (/tmp) Inode Used >=90% - Group(Filesystem) Volume(/tmp) Type(UUsedInodesPercent) Trigger(>=90%)
  • Filesystem (/usr) Disk Space Used >=80% - Group(Filesystem) Volume(/usr) Type(UsedPercent) Trigger(>=80%)
  • Filesystem (/usr) Does Not Exist - Group(Filesystem) Volume(/usr) Trigger(Does Not Exist)
  • Filesystem (/usr) Inode Used >=90% - Group(Filesystem) Volume(/usr) Type(UUsedInodesPercent) Trigger(>=90%)
  • Filesystem (/var) Disk Space Used >=80% - Group(Filesystem) Volume(/var) Type(UsedPercent) Trigger(>=80%)
  • Filesystem (/var) Does Not Exist - Group(Filesystem) Volume(/var) Trigger(Does Not Exist)
  • Filesystem (/var) Inode Used >=90% - Group(Filesystem) Volume(/var) Type(UUsedInodesPercent) Trigger(>=90%)
  • Sustained CPU >95% - Group(CPU) CPU(0) Type(Load) Trigger(>95%)

Contains the following rules:

  • Critical Process (biod) Does Not Exist - Type(Process By Name) Process(biod) Trigger(DoesNotExist)
  • Critical Process (cron) Does Not Exist - Type(Process By Name) Process(cron) Trigger(DoesNotExist)
  • Critical Process (errdemon) Does Not Exist - Type(Process By Name) Process(errdemon) Trigger(DoesNotExist)
  • Critical Process (inetd) Does Not Exist - Type(Process By Name) Process(inetd) Trigger(DoesNotExist)
  • Critical Process (portmap) Does Not Exist - Type(Process By Name) Process(portmap) Trigger(DoesNotExist)
  • Critical Process (qdaemon) Does Not Exist - Type(Process By Name) Process(qdaemon) Trigger(DoesNotExist)
  • Critical Process (syncd) Does Not Exist - Type(Process By Name) Process(syncd) Trigger(DoesNotExist)
  • Critical Process (writesrv) Does Not Exist - Type(Process By Name) Process(writesrv) Trigger(DoesNotExist)

Contains a single rule:

  • Check Server Can Ping Router - Host(1.2.3.4) Timeout(2000) Attempts(4) Success(50%) TTL(128)
NOTE: All actions for each of the above rules within this template are set to a default of sending an alert to the Enterprise Console. You must manually change this setting if you require an alternative action to be taken upon the generation of an alert.

Related Topics