Operating System Monitoring - Objects filters

In some cases it might be required to configure operating system objects - for example file systems - which are to be included or excluded from the Operating System monitoring process. As of SAP Host Agent 721 PL31 ,  you can configure that the operating system objects are monitored in the osfilter.conf  file. This file is located within the configuration directory of SAP Host Agent : /usr/sap/hostctrl/exe/config.d (on UNIX) or C:\Program Files\SAP\hostctrl\exe\config.d\ (on Windows).

• The file can contain several rules to read line by line
• The syntax of one line is the following:

  <ObjectType>[+/-]: <attribute>(<pattern>) <attribute>(<pattern>)...

• There are 2 types of rule: Including rules specified by  [+] and excluding rules specified by  [-]
  • Including rules can omit the [+] sign .
• All lines starting with a # sign are ignored and considered as comment lines.
• If neither rules nor a specific <ObjectType> are specified , then all Objects of this type are included within the operating system monitoring process.
• As soon as one single rule is defined, the matching process is executed according to the following rules:
  • <pattern> specifies a string supporting special wildcards signs:
    * : Matches any character (0 or many occurrence)
    ? : Matches exactly one occurrence of any character
    ! : Negates the match only if specified at the begin of the pattern
  • All Including [+] rules are processed using an OR operator.
  • Each <attribute>   of one single rule (separated by whitespace) matches using an AND operator.
  • The first matching exclude [-] rule excludes the object from the process without further processing.

This means in general that you can choose between two generic approaches which return the same results:

1. Define only include rules which matches the object you would like to monitor.
2. Define include rules and exclude afterwards the object you want to  exclude explicitly.

There are advantages and disadvantages when using approach 1 or 2. You can decide on the best approach only based on the requirements of the use case.

The supported <ObjectType>  is currently : Filesystem and Process

Filesystem

In general, the Filesystem object supports the following attributes : mount , device , type

• mount matches the mount point name of the file system
• device matches the device specified
• type matches the file system type

You can find all attributes executing the command mount or df on Linux, for example:

 root@lu0140:/# df -T
Filesystem     Type     1K-blocks      Used Available Use% Mounted on
udev           devtmpfs  16365328         0  16365328   0% /dev
tmpfs          tmpfs      3277964     18436   3259528   1% /run
/dev/nvme0n1p2 ext4     458752176 430244196   5181672  99% /
tmpfs          tmpfs     16389808    399092  15990716   3% /dev/shm
tmpfs          tmpfs         5120         4      5116   1% /run/lock
tmpfs          tmpfs     16389808         0  16389808   0% /sys/fs/cgroup
/dev/nvme0n1p1 vfat        523248      3480    519768   1% /boot/efi
tmpfs          tmpfs      3277964         0   3277964   0% /run/user/998
tmpfs          tmpfs      3277964        84   3277880   1% /run/user/11443

Here an example of a configuration file for file systems:

#
# Syntax:
#   <ObjectType>[+/-]: <attribute>(<pattern>);...<attribute>(<pattern>)
#       + = include,
#       - = exclude,
#       <ObjectType> = Filesystem, Process
#       <attribute> :
#           Filesystem  ->  mount, device, type (or Mount, Device, Type for case-sensitive match)
#           Process     ->  cmd, user (or Cmd, User for case-sensitive match)
#       <pattern> : support  !, *, ?
#                   ! only @ begin of the pattern negate the match
#                   * match any character (0 or many occurrence)
#                   ? match 1 occurrence of any charachter
#   In general all [+] filter are aggregated using the or operation
#   but as soon a [-] match the FileSystem is excluded without any additional check!
#   
#   If no filter is set all objects are selected.
#   As soon 1 single filter, for the ObjectType, is set nothing except the matching rule is selected.

Filesystem[+]: mount(*)
Filesystem[-]: type(proc)
Filesystem[-]: type(*tmp*)
Filesystem[-]: type(sys*)
Filesystem[-]: type(cgroup*)

The filter process is executed as follow:

• The rule Filesystem[+]: mount(*) will include all mount points . This step is necessary otherwise no file systems are selected.
• The line Filesystem[-]: type(proc) will exclude from the set of file systems selected before, all entry matching the file system type proc 
• The line Filesystem[-]: type(*tmp*) will exclude from the precedent selection the file system with type '*tmp*'. In the above example all tmpfs and devtmpfs file system type

You can test the file system filters e.g. with the following command:

 root@lu0140:/# /usr/sap/hostctrl/exe/saphostctrl -function ListOSMetrics -metype FileSystem
Timestamp           Metric                            MeasuredElement              Value Unit
2018-06-20-16:20:18 FS.AvailableSpace                 /                       5303058432 Bytes
2018-06-20-16:20:18 FS.Size                           /                     469762228224 Bytes
2018-06-20-16:20:18 FS.AvailableSpace                 /boot/efi                532242432 Bytes
2018-06-20-16:20:18 FS.Size                           /boot/efi                535805952 Bytes

Process

In general, the Process object supports the following attributes: cmd, user

• cmd matches the command line of the process

• user matches the user name of the process

You can find all attributes executing the ps command on Linux, for example:

root@lu0140:/# ps -ef | grep hostctrl
D039028@wdfn34097272a2:~$ ps -ef | grep hostctrl
root     12727  2477  0 10:27 ?        00:00:00 /usr/sap/hostctrl/exe/saphostexec pf=/usr/sap/hostctrl/exe/host_profile
sapadm   12731  2477  0 10:27 ?        00:00:03 /usr/sap/hostctrl/exe/sapstartsrv pf=/usr/sap/hostctrl/exe/host_profile -D
root     12810  2477  0 10:27 ?        00:00:18 /usr/sap/hostctrl/exe/saposcol -l -w60 pf=/usr/sap/hostctrl/exe/host_profile

 Here an example of a configuration file for processes:

Process: cmd(*sapstartsrv*) user(sapadm)
Process: cmd(*saphostexec*) 
Process: cmd(*saposcol*)

You can test the process filters e.g. with the following command: 

root@lu0140:/# /usr/sap/hostctrl/exe/saphostctrl -function ListOSProcesses
  PID User      PR    RSS    CPU Time Command
12727 root      20    11m    00:00:00 /usr/sap/hostctrl/exe/saphostexec pf=/usr/sap/hostctrl/exe/host_profile
12731 sapadm    20    39m    00:00:03 /usr/sap/hostctrl/exe/sapstartsrv pf=/usr/sap/hostctrl/exe/host_profile -D
12810 root      20  7816k    00:00:18 /usr/sap/hostctrl/exe/saposcol -l -w60 pf=/usr/sap/hostctrl/exe/host_profile

Conversion from saposcol FileSystem filter

If customers already use the saposcol functionality specified in SAP Note 498112 , we offer a conversion tool called  convertoscolfilter .

You can run this tool as follows:

 $ ./convertoscolfilter 
Usage:
      -fs   <path to sapocol dev_filter>
      [-out <path to the output file:] [default osfilter.conf]

By default, the tool prints the converted filter in stdout. You can override this behavior by providing the argument -out with the <path> to be used.
If the file provided to -out already exists, a new file called <path>.new  is created. Then the tool prints the following message:

 $ ./convertoscolfilter -fs dev_filter -out osfilter.conf 
INFO: 'osfilter.conf' exists uses 'osfilter.conf.new' instead
$