SAP Operating System Monitoring - Objects filters

Operating System Monitoring - Objects filters

In some cases it might be required to configure operating system objects - for example file systems - which are to be included or excluded from the Operating System monitoring process. As of SAP Host Agent 721 PL31 ,  you can configure that the operating system objects are monitored in the osfilter.conf  file. This file is located within the configuration directory of SAP Host Agent : /usr/sap/hostctrl/exe/config.d (on UNIX) or C:\Program Files\SAP\hostctrl\exe\config.d\ (on Windows).

• The file can contain several rules to read line by line
• The syntax of one line is the following:

  [+/-]: () ()...

• There are 2 types of rule: Including rules specified by  [+] and excluding rules specified by  [-]
  • Including rules can omit the [+] sign .
• All lines starting with a # sign are ignored and considered as comment lines.
• If neither rules nor a specific  are specified , then all Objects of this type are included within the operating system monitoring process.
• As soon as one single rule is defined, the matching process is executed according to the following rules:
  •  specifies a string supporting special wildcards signs:
    * : Matches any character (0 or many occurrence)
    ? : Matches exactly one occurrence of any character
    ! : Negates the match only if specified at the begin of the pattern
  • All Including [+] rules are processed using an OR operator.
  • Each    of one single rule (separated by whitespace) matches using an AND operator.
  • The first matching exclude [-] rule excludes the object from the process without further processing.

This means in general that you can choose between two generic approaches which return the same results:

1. Define only include rules which matches the object you would like to monitor.
2. Define include rules and exclude afterwards the object you want to  exclude explicitly.

There are advantages and disadvantages when using approach 1 or 2. You can decide on the best approach only based on the requirements of the use case.

The supported   is currently : Filesystem and Process

 saposcol offered a similar functionality in the past. For more information, see SAP Note 498112 . See also SAP Note 1102124  for special requirements on Linux.

Filesystem

In general, the Filesystem object supports the following attributes : mount , device , type

• mount matches the mount point name of the file system
• device matches the device specified
• type matches the file system type

You can find all attributes executing the command mount or df on Linux, for example:

df output

root@lu0140:/# df -T Filesystem     Type     1K-blocks      Used Available Use% Mounted on udev           devtmpfs  16365328         0  16365328   0% /dev tmpfs          tmpfs      3277964     18436   3259528   1% /run /dev/nvme0n1p2 ext4     458752176 430244196   5181672  99% / tmpfs          tmpfs     16389808    399092  15990716   3% /dev/shm tmpfs          tmpfs         5120         4      5116   1% /run/lock tmpfs          tmpfs     16389808         0  16389808   0% /sys/fs/cgroup /dev/nvme0n1p1 vfat        523248      3480    519768   1% /boot/efi tmpfs          tmpfs      3277964         0   3277964   0% /run/user/998 tmpfs          tmpfs      3277964        84   3277880   1% /run/user/11443

Here an example of a configuration file for file systems:

osfilter.conf

# # Syntax: #   [+/-]: ();...() #       + = include, #       - = exclude, #       = Filesystem, Process #       : #           Filesystem  ->  mount, device, type (or Mount, Device, Type for case-sensitive match) #           Process     ->  cmd, user (or Cmd, User for case-sensitive match) #       : support  !, *, ? #                   ! only @ begin of the pattern negate the match #                   * match any character (0 or many occurrence) #                   ? match 1 occurrence of any charachter #   In general all [+] filter are aggregated using the or operation #   but as soon a [-] match the FileSystem is excluded without any additional check! #   #   If no filter is set all objects are selected. #   As soon 1 single filter, for the ObjectType, is set nothing except the matching rule is selected. Filesystem[+]: mount(*)   Filesystem[-]: type(proc) Filesystem[-]: type(*tmp*) Filesystem[-]: type(sys*) Filesystem[-]: type(cgroup*)

You can test the file system filters e.g. with the following command:

ListOSMetrics

root@lu0140:/# /usr/sap/hostctrl/exe/saphostctrl -function ListOSMetrics -metype FileSystem Timestamp           Metric                            MeasuredElement              Value Unit 2018-06-20-16:20:18 FS.AvailableSpace                 /                       5303058432 Bytes 2018-06-20-16:20:18 FS.Size                           /                     469762228224 Bytes 2018-06-20-16:20:18 FS.AvailableSpace                 /boot/efi                532242432 Bytes 2018-06-20-16:20:18 FS.Size                           /boot/efi                535805952 Bytes

Process

In general, the Process object supports the following attributes: cmd, user

• cmd matches the command line of the process
• user matches the user name of the process

You can find all attributes executing the ps command on Linux, for example:

ps output

root@lu0140:/# ps -ef | grep hostctrl D039028@wdfn34097272a2:~$ ps -ef | grep hostctrl root     12727  2477  0 10:27 ?        00:00:00 /usr/sap/hostctrl/exe/saphostexec pf=/usr/sap/hostctrl/exe/host_profile sapadm   12731  2477  0 10:27 ?        00:00:03 /usr/sap/hostctrl/exe/sapstartsrv pf=/usr/sap/hostctrl/exe/host_profile -D root     12810  2477  0 10:27 ?        00:00:18 /usr/sap/hostctrl/exe/saposcol -l -w60 pf=/usr/sap/hostctrl/exe/host_profile

 Here an example of a configuration file for processes:

osfilter.conf

Process: cmd(*sapstartsrv*) user(sapadm) Process: cmd(*saphostexec*) Process: cmd(*saposcol*)

You can test the process filters e.g. with the following command: 

ListOSProcesses

root@lu0140:/# /usr/sap/hostctrl/exe/saphostctrl -function ListOSProcesses   PID User      PR    RSS    CPU Time Command 12727 root      20    11m    00:00:00 /usr/sap/hostctrl/exe/saphostexec pf=/usr/sap/hostctrl/exe/host_profile 12731 sapadm    20    39m    00:00:03 /usr/sap/hostctrl/exe/sapstartsrv pf=/usr/sap/hostctrl/exe/host_profile -D 12810 root      20  7816k    00:00:18 /usr/sap/hostctrl/exe/saposcol -l -w60 pf=/usr/sap/hostctrl/exe/host_profile

Conversion from saposcol FileSystem filter

If customers already use the saposcol functionality specified in SAP Note 498112 , we offer a conversion tool called  convertoscolfilter .

You can run this tool as follows:

convertoscolfilter

$ ./convertoscolfilter Usage:       -fs         [-out default osfilter.conf]

By default, the tool prints the converted filter in stdout. You can override this behavior by providing the argument -out with the  to be used.
If the file provided to -out already exists, a new file called .new  is created. Then the tool prints the following message:

$ ./convertoscolfilter -fs dev_filter -out osfilter.conf INFO: 'osfilter.conf' exists uses 'osfilter.conf.new' instead $