AIX:Event Monitoring with AHAFS

Starting with AIX 6100-06 and 7100-00, IBM introduced the AIX Event Infrastructure for monitoring pre-defined and user-defined system events—such as modification of a file’s content, utilization of a filesystem exceeding a user-defined threshold, death of a process or a change in the value of a kernel tunable parameter—without the high overhead of polling. This infrastructure can automatically notify registered users or processes instantly about the occurrences of such events, with information useful for maintaining and improving the health and security of the running AIX instance. The information provided in the notification includes the what, when, who and where the event happened, and it can include the whole function call-chain that triggered the event. At the core of the AIX Event Infrastructure is a pseudo-filesystem: Autonomic Health Advisor FileSystem (AHAFS), which is implemented as a kernel extension. AHAFS mainly acts as a mediator to take the requests of event registration, monitoring and unregistering from the processes interested in monitoring for events. It forwards the requests to the corresponding event producers (code responsible for triggering the occurrence of an event) in the kernel space, processes the callback functions when the event occurs, and notifies the registered users or processes with useful information.