Appendix D Sun Management Center Software Rules
This appendix lists the Sun Management Center rules for the following modules:
Rules Concepts
A rule is an alarm check mechanism that allows for complex or special purpose
logic in determining the status of a monitored host or node.
There are two types of rules:
-
Simple rules are based on the rCompare rule, in which monitored properties are compared to the rule. If the rule
condition becomes true, an alarm is generated. For example, a simple rule can be the
percentage of disk space used. If the percentage of disk space used is greater than
or equal to the percentage specified in the rule, then an alarm is generated.
-
Complex rules are based on multiple conditions.
For example, one complex rule states that an alert alarm is generated when the following
conditions are met:
-
The disk is over 75% busy
-
The average queue length is over 10
-
The wait queue is increasing
Note –
Any user-customized Solstice SyMONTM 1.x rules must be ported to the Sun Management Center environment before the rules
can be used in Sun Management Center software.
Kernel Reader
The following table lists the Kernel Reader simple rules.
Table D–1 Kernel Reader Simple Rules
|
Property
|
Description
|
|
avg_1min
|
Load average over the last minute
|
|
avg_5min
|
Load average over the last 5 minutes
|
|
avg_15min
|
Load average over the last 15 minutes
|
|
cpu_delta
|
Difference between the previous and current time
|
|
cpu_idle
|
CPU idle time
|
|
cpu_kernel
|
CPU kernel time
|
|
cpu_user
|
CPU user time
|
|
cpu_wait
|
CPU wait time
|
|
ipctused
|
Percent of inodes used
|
|
kpctused
|
Percent of Kbytes used
|
|
mem-inuse
|
Physical memory in use (Mbytes)
|
|
numusers
|
Number of users
|
|
numsessions
|
Number of user sessions
|
|
swap_used
|
Swap used (Kbytes)
|
|
wait_io
|
CPU wait time breakdown
|
|
wait_pio
|
CPU wait time breakdown
|
|
wait_swap
|
CPU wait time breakdown
|
The following table lists the Kernel Reader complex rules.
Table D–2 Kernel Reader Complex Rules
|
Rule ID
|
Description
|
Type of Alarm
|
|
rknrd100
|
This rule covers a transitory event. The rule generates an alert alarm
when the disk is over 75% busy, the average queue length is over 10, and the wait
queue is increasing. The alert alarm remains until the disk is less than 70% busy
and the average queue length is less than 8.
|
Alert
|
|
rknrd102
|
This rule covers a transitory event. The rule generates an alert alarm
if 90% of swap space is in use. The event causing the alarm remains until swap space
in use is less than 80% of the total swap space.
|
Alert
|
|
rknrd103
|
This rule covers a transitory event. The rule generates an alert alarm
if swapping and paging is high for a given CPU. This behavior indicates that a CPU
might be thrashing. An alert alarm is generated when CPU exceeds 1 swap-out, 10 page-ins,
and 10 page-outs per second. The alert alarm stays on if CPU exceeds 1 swap-out, 8
page-ins, and 8 page-outs per second.
|
Alert
|
|
rknrd105
|
File System Full error. This rule looks for a file system full error message
in the syslog (/var/adm/message).
|
Alert alarm that is closed immediately
|
|
rknrd106
|
No swap space error. This rule looks for a no swap space error message
in the syslog (/var/adm/message).
|
Alert alarm that is closed immediately
|
|
rknrd400
|
This rule checks for a continuous CPU load over six per CPU for four hours.
|
Informational
|
|
rknrd401
|
This rule checks for disks that are busy more than 90% of the file for x hours. The parameters field holds the last time CPU load was below
six, and is initialized to some date in the year 2001.
|
Informational
|
|
rknrd402
|
This rule checks if available swap space drops below 10% for x hours. The parameters field indicates the last time that the CPU load
was below six. This field is initialized to some date in the year 2001.
|
Informational
|
|
rknrd403
|
This rule is not currently supported.
|
Informational
|
|
rknrd404
|
An informational alarm is generated if rule rknrd401 gets triggered 4 times.
|
Informational
|
|
rknrd405
|
An informational alarm is generated if rule rknrd402 gets triggered 4 times.
|
Informational
|
Health Monitor
The following table lists the Health Monitor complex rules.
Table D–3 Health Monitor Complex Rules
|
Rule ID
|
Description
|
Type of Alarm
|
|
rhltm000
|
This rule checks whether there is enough swap space.
|
Critical, Alert, Caution
|
|
rhltm001
|
CPU power is wasted each time a CPU has to wait for a lock to become free.
This event is counted because the kernel uses mutually exclusive locks to synchronize
its operation and to keep multiple CPUs from concurrently accessing critical code
and data regions.
|
Critical, Alert, Caution
|
|
rhltm002
|
NFS remote procedure call timeouts may be associated with duplicate responses
after the call is retransmitted. These timeouts indicate that the network is okay
but the server is responding slowly.
|
Critical, Alert, Caution
|
|
rhltm003
|
The run queue length is divided by the number of CPUs because every CPU
takes a job off the run queue in each time slice.
|
Critical, Alert, Caution
|
|
rhltm004
|
A busy disk or a slow disk reduces system throughput and increases user
response times. This rule identifies the disks that are loaded so that the load can
be rebalanced.
|
Critical, Alert, Caution
|
|
rhltm005
|
RAM rule based on residency time for an unreferenced page. The virtual
memory system indicates that the system needs more memory when the system scans to
look for idle pages to reclaim for other uses.
|
Critical, Alert, Caution
|
|
rhltm006
|
This rule refers to the problem with kernel memory allocation that occurs
when login attempts or network connections fail unexpectedly. There are two possible
causes: Either the kernel has reached the extent of its address space, or the free
list does not contain any pages to allocate. The repeated failures signify a problem
that might otherwise be overlooked.
|
Critical, Alert, Caution
|
|
rhltm007
|
A global cache of directory path name components exists. This cache is called
the directory name lookup cache (DNLC). If this cache does not exist, directory entries
must be read from disk and be scanned to locate the right file.
|
Critical, Alert, Caution
|
