Removing Sockets

If a client-server application hangs you may need to kill it and remove the connection before you can try again. In this case you also need to remove the hung socket, rather than waiting for it to time-out and CLOSE_WAITs will not go away unless you boot the system. They also consume lot of CPU and can cause the system to hang.

# netstat -Aan
shows you the partners of the session, the routing table is used to determine which adapter is to be used to get that packet across the network to the partner

Once you have the client and server addresses you can run: netstat -rn and see which route rule is taken. The entry to the left to the "IF" Column tells you which which adapter is being used.

Now from the rmsock you determined that the process of that established connection is a process call MTproc (could be anything) with a pid of nnnnn that has to use enI (from IF column) to send packet.

If there are no rules than the default applies

Assuming your server ip address is 12.46.67.8 and the TCPCB address you used is something like
f1000e0001a413b8 tcp4 0 0 12.46.67.8.45179 12.46.67.182 ESTABLISHED
# rmsock f1000e0001a413b8 tcpcb. Tels you the process is MTproc

Now check the "IF" column in the netstat -rn output and see which adapter is being used.

Next use the rmsock command to check who is holding the process.

# rmsock <addr of PCB> tcpcb

It can also checked as follows:

# netstat -Aan | grep 2100
f1000e0000da93b0 tcp4 0 0 127.0.0.1.2100 *.* LISTEN
f1000e0000d9b600 udp4 0 0 127.0.0.1.2100 *.*
f1000e0000662100
f1000e000066e008 stream 0 0 0 f1000e0000662100 0 0

# rmsock f1000e0000da93b0 tcpcb

The socket 0xda9008 is being held by proccess 4653166

# ps -fp 4653166
user 4653166 1 0 05:41:12 pts/1 0:00 /MYAPPXXX

Killing this process should release the socket.

Stopping the Director agent

If you are not using the Director you may as well stop the agent and save some memory and resources on your system:

Stopping the director agent

# /opt/ibm/director/agent/runtime/agent/bin/endpoint.sh stop

Stop the subsystems
# stopsrc -s platform_agent
# stopsrc -s cimsys
Remove the start-up entries from "/inittab":

cimservices:2:once:/usr/bin/startsrc -s cimsys >/dev/null 2>&1
platform_agent:2:once:/usr/bin/startsrc -s platform_agent >/dev/null 2>&1


# rmitab cimservices
# rmitab platform_agent

The agent should no longer startup during boot.

Preventing users from choosing obvious passwords

Edit the default stanza in the "/etc/security/user" file using the following command:

# chsec -f /etc/security/user -s default -a dictionlist=/etc/security/aixpert/dictionary/English

The "English" file contains a list of common English names and words. You can either extend this file with your own banned words or create a list of your own.

Patching AIX from the command-line

Many people use SMIT when updating AIX and/or NIM but do not realise that they can also do this from the command-line using two IBM-supplied sctripts. Patches downloaded from Fix Central should all be in one directory e.g. "6100-08-02-1316".

Change to the directory containing the patches and ensure that it is writeable, so inutoc can create/update the index, all that the files are readable by root.

# cd 6100-08-02-1316
# inutoc .

Run the patch-install script:

# install_all_updates -d . -Y

+-----------------------------------------------------------------------------+
                                Summaries:
+-----------------------------------------------------------------------------+

Pre-installation Failure/Warning Summary
----------------------------------------
Name                      Level           Pre-installation Failure/Warning
-------------------------------------------------------------------------------
sysmgt.websm.rte          6.1.7.1         Requisite failure
sysmgt.pconsole.rte       6.1.7.2         Requisite failure
perfagent.tools           6.1.7.2         Requisite failure
devices.vdevice.IBM.v-scs...
...

 The results will not only be displayed on the screen but stored in "/var/adm/ras/install_all_updates.log".

You now reboot your system to ensure everything is working OK and once satisfied you can commit all the newly applied fixes in order to remove the old copies and save a lot of space in "/usr".

# installp -c ALL
# oslevel -s
6100-08-02-1316

If you are using NIM you will also want to update your LPP_SOURCE so that any new clients will be built to the same OS level. Fortunately this can also be done from the command-line:

Note: NIM can only be patched this way to TL (tech-levels) and not SP (Service Packs).

# cd <patch-directory>
# nim_update_all -d . -s 610spot_res -l 610lpp_res -v -u
+ typeset +f
+ typeset -ft DEBUG
+ typeset -ft _check_level
+ typeset -ft bname
+ typeset -ft check_access
+ typeset -ft check_cpush_ok
+ typeset -ft check_level
+ typeset -ft check_push_ok
+ typeset -ft ck_attrs
+ typeset -ft ck_gencopy_flags
+ typeset -ft ck_inst_root_dirs
+ typeset -ft ck_installp_flags
+ typeset -ft ck_rel_level
+ typeset -ft ck_spot_options
+ typeset -ft cleanup
+ typeset -ft cmd_what
+ typeset -ft convert_arch_value
+ typeset -ft create_sysb
+ typeset -ft err_from_cmd
+ typeset -ft err_signal
+ typeset -ft error
...
..
395266 of 422959 files (93%)....................

0512-003 mksysb may not have been able to archive some files.
The messages displayed on the Standard Error contained additional
information.
+ [[ 0 -ne 0 ]]
+ return 0
+ [ 0 -ne 0 ]
+ /usr/bin/tee -a /var/adm/ras/nim.update
+ /usr/bin/dspmsg -s 2 cmdnim.cat 338 \nNIM update_all is complete - enjoy!

NIM update_all is complete - enjoy!
Your SPOT and LPP_SOURCE should now be at the same level.

# lsnim -l 610spot_res

610spot_res:
   class         = resources
   type          = spot
   plat_defined  = chrp
   arch          = power
   Rstate        = ready for use
   prev_state    = verification is being performed
   location      = /export/eznim/spot/610spot_res/usr
   version       = 6
   release       = 1
   mod           = 8
   oslevel_r     = 6100-08
   alloc_count   = 0
   server        = master
   Rstate_result = success
   mk_netboot    = yes
   mk_netboot    = yes
   mk_netboot    = yes

Putting installp into debug mode

If you are having problems installing a product or patch try enabling "debugger mode":

# export INST_DEBUG=yes
# installp ...

Installing RPMs

Installing RPMs in AIX can be a real pain and a lot of time can be spent looking for the dependant packages etc. This is a quick tip which enables you to see a package's contents and dependencies without having to try to install it:

To see some background information:

# rpm -qpi ./sudo-1.8.9p5-1.aix5.1.ppc.rpm
Name        : sudo                         Relocations: (not relocateable)
Version     : 1.8.9p5                           Vendor: (none)
Release     : 1                             Build Date: Thu Feb  6 14:46:56 CET 2014
Install date: (not installed)               Build Host: aix51.perzl.org
Group       : Applications/System           Source RPM: sudo-1.8.9p5-1.src.rpm
Size        : 1571387                          License: BSD
URL         : http://www.courtesan.com/sudo/
Summary     : Allows restricted root access for specified users
Description :
Sudo (superuser do) allows a system administrator to give certain
users (or groups of users) the ability to run some (or all) commands
as root while logging all commands and arguments. Sudo operates on a
per-command basis.  It is not a replacement for the shell.  Features
include: the ability to restrict what commands a user may run on a
per-host basis, copious logging of each command (providing a clear
audit trail of who did what), a configurable timeout of the sudo
command, and the ability to use the same configuration file (sudoers)
on many different machines.

Adding the "--changelog" argument also lets you see all the author's publising information:

# rpm -qpi --changelog ./sudo-1.8.9p5-1.aix5.1.ppc.rpm
...
.
* Thu Feb 06 2014 Michael Perzl <michael@perzl.org> - 1.8.9p5-1

- updated to version 1.8.9p5

* Tue Jan 21 2014 Michael Perzl <michael@perzl.org> - 1.8.9p4-1

- updated to version 1.8.9p4
..


To see the dependencies:

# rpm -qpR ./sudo-1.8.9p5-1.aix5.1.ppc.rpm
gettext >= 0.10.40
openldap >= 2.4.23
openssl >= 1.0.1f-1
zlib
/bin/sh
libc.a(shr.o)
libcrypto.a(libcrypto.so.1.0.1)
libintl.a(libintl.so.1)
liblber.a(liblber-2.4.so.2)
libldap.a(libldap-2.4.so.2)
libs.a(shr.o)
libz.a(libz.so.1)

You can also see the files in the package and importantly where it is going to be installed:

# rpm -qpl ./sudo-1.8.9p5-1.aix5.1.ppc.rpm
/etc/sudoers
/opt/freeware/bin/sudo
/opt/freeware/bin/sudoedit
/opt/freeware/bin/sudoreplay
/opt/freeware/doc/sudo-1.8.9p5
/opt/freeware/doc/sudo-1.8.9p5/HISTORY
/opt/freeware/doc/sudo-1.8.9p5/LICENSE
/opt/freeware/doc/sudo-1.8.9p5/README
/opt/freeware/doc/sudo-1.8.9p5/TROUBLESHOOTING
/opt/freeware/doc/sudo-1.8.9p5/UPGRADE
/opt/freeware/libexec/sudo/group_file.so
/opt/freeware/libexec/sudo/sudo_noexec.so

IBM releases latest version of Cloud Manager

IBM is moving ever closer to Linux an Openstack with their latest software release:

http://www-304.ibm.com/partnerworld/wps/servlet/ContentHandler/stg_com_sys-cloud-manager-with-openstack

The 90 day (IBM Partner) trial has a pretty hefty including copies of RHEL6, DB2, and MySQL, however if you have the time and a spare system I think it will be worth it.

I personally think that this is a very significant announcement as it gives a clear illustration of IBM's general future business strategy.