Deployment Architecture

expected behavior of lsof for *nix

Branden
Builder

I recently made a stab at porting the lsof *nix app to AIX. I realize this is an unsupported configuration, but we AIX users feel left out!

Anyways, it wasn't that hard to port. We already had lsof for AIX compiled. I just modified common.sh to fake it into believing it supports AIX, copied the props.conf, and off I went.

It runs lsof.sh and indexes the information, but I guess I was expecting more. Maybe I have more work to do on porting it, but for now it seems to just run lsof and captures the output of the command into a single 500 line entry. No special fields or anything like that.

Is that the expected behavior of lsof for *nix? Or is there more to it that I am missing? What is the difference between lsof for *nix versus running lsof.sh as your own app?

Thanks!

Tags (1)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

There isn't a big difference, and shouldn't be. The only reason we have the scripts is to make sure that the "right" fields are output, and that the same fields are output with the same names across different platforms, and that the "right" options are specified to render the correct output (e.g., resolve hostnames vs show IP addresses, resolve port names vs numbers, show files or just network ports, UDP vs TCP ports, etc.)

So yes, the script is meant to be very simple, just to standardize the data that goes into Splunk. Any sophistication comes afterwards from the searches in the *nix application dashboards, which make assumptions about what data is present and how it is named.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

There isn't a big difference, and shouldn't be. The only reason we have the scripts is to make sure that the "right" fields are output, and that the same fields are output with the same names across different platforms, and that the "right" options are specified to render the correct output (e.g., resolve hostnames vs show IP addresses, resolve port names vs numbers, show files or just network ports, UDP vs TCP ports, etc.)

So yes, the script is meant to be very simple, just to standardize the data that goes into Splunk. Any sophistication comes afterwards from the searches in the *nix application dashboards, which make assumptions about what data is present and how it is named.

Branden
Builder

Good info, thanks!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...