Showing posts with label awk. Show all posts
Showing posts with label awk. Show all posts

Friday, February 17, 2023

NAWK: How can I get uptime & boot time in Solaris?

 

[Solaris Logo, courtesy former Sun Microsystems, Oracle]

Abstract:

This is part of a small article series on lesser known uses of UNIX nawk. Why nawk? This POSIX language has not changed in decades, gets very few code changes, and is mostly bug free in any reasonable operating system. Scripts written in POSIX nawk will basically run, forever. Master this simple language, and there is virtually nothing that can not be done.

What is AWK?

Awk is a scriptable text language, originally written by the authors of UNIX and C: Alfred Aho, Peter Weinberger, and Brian Kernighan. It's concepts are managing Page Header (the BEGIN clause), Page Body (multiple Pattern -> Action clauses), and Page Footer (the END clause.) 

Awk is suitable for building & manipulating any textual or markup text, which is page oriented (i.e. SQL output, Text, Adobe PostScript, Adobe FrameMaker portable maker format, HTML, XML, Microsoft RTF, Microsoft CSV, etc.)

NAWK: How can I get uptime & boot time in Solaris?

The CTime or Epoch Time can be easily retrieved from nawk using the "srand()" function, if there is no seed passed into the function. This number represents the seconds since 00:00:00 on January 1, 1970.

The boot time is the CTime/Epoch Time [in seconds], at the time of the last OS boot, and can be retrieved from "kstat". Simple subtraction and division can provide reasonably accurate conversions.

The following examples show: CTime, Boot Time, Seconds Difference, Minutes Difference, Hours Difference, Days Difference.

Example 1 - Solaris 10:

Solaris10/root# kstat -n system_misc | nawk '
BEGIN { CTime=srand() };
/boot_time/ { BTime=$2; Diff=CTime-BTime };
END { printf "CTime:\t%s\nBTime:\t%s\nScDif:\t%s\nMnDif:\t%s\nHrDif:\t%s\nDyDif:\t%s\n",
      CTime,BTime,Diff,Diff/60,Diff/60/60,Diff/60/60/24 }'

CTime:  1676683570
BTime:  1676106161
ScDif:  577409
MnDif:  9623.48
HrDif:  160.391
DyDif:  6.68297

Example 2 - Solaris 11:

Solaris 11/root# kstat -n system_misc | nawk '
BEGIN { CTime=srand() };
/boot_time/ { BTime=$2; Diff=CTime-BTime };
END { printf "CTime:\t%s\nBTime:\t%s\nScDif:\t%s\nMnDif:\t%s\nHrDif:\t%s\nDyDif:\t%s\n",
      CTime,BTime,Diff,Diff/60,Diff/60/60,Diff/60/60/24 }'

CTime:  1676683533
BTime:  1662691183
SecDif: 13992350
MinDif: 233206
HrDif:  3886.76
DayDif: 161.948

Does the code look similar? It should, Solaris 10 and Solaris 11 are POSIX compliant.

What about GAWK?

GNU's Awk is not 100% compatible with POSIX Nawk, which is a huge disappointment. I have seen code, which worked for decades, never able to run unchanged under GNU's awk.

 

Tuesday, May 29, 2012

Network Management Hint: Sort by IP Address

Network Management Hint: Sort by IP Address

How do you sort a host table by IP Address on a UNIX network management platform?

This has been a basic requirement, since the dawn of The Internet.

Let's look at an example /etc/hosts extract:
sun9999/user$ cat /etc/hosts
#
127.0.0.1       localhost
::1             localhost

201.14.24.17    BT-Site-1       # LasPalmas
203.16.54.112   QB-Site-1       # NorthSydney
201.14.24.21    DL-Site-1       # LasPalmas
202.135.192.97  QB-Site-1       # NorthSydney
203.16.54.18    PR-Site-1       # NorthSydney
201.14.24.28    DL-Site-2       # LasPalmas
203.16.54.22    KP-Site-1       # NorthSydney

Each octet in an IPv4 address is separated by a period "." and a simple POSIX sort will use the period as the field separator and then request a numeric sort on the first, second, third, and fourth octets.
sun9999/user$ sort -t . -k 1,1n -k 2,2n -k 3,3n -k 4,4n /etc/hosts

::1 localhost
#
127.0.0.1
       localhost
201.14.24.17
    BT-Site-1     # LasPalmas
201.14.24.21
    DL-Site-1     # LasPalmas
201.14.24.28
    DL-Site-2     # LasPalmas
202.135.192.97
  QB-Site-1     # NorthSydney
203.16.54.18
    PR-Site-1     # NorthSydney
203.16.54.22
    KP-Site-1     # NorthSydney
203.16.54.112
   QB-Site-1     # NorthSydney

What it you want to eliminate colon ":" separated IPv6 addresses, empty lines, and lines with comments? Just perform a little POSIX awk'ing after the sort.
sun9999/user$ sort -t . -k 1,1n -k 2,2n -k 3,3n -k 4,4n /etc/hosts | awk '$1!~/:/ && !/^$/ && !/^#/'
127.0.0.1       localhost
201.14.24.17    BT-Site-1       # LasPalmas
201.14.24.21    DL-Site-1       # LasPalmas
201.14.24.28    DL-Site-2       # LasPalmas
202.135.192.97  QB-Site-1       # NorthSydney
203.16.54.18    PR-Site-1       # NorthSydney
203.16.54.22    KP-Site-1       # NorthSydney
203.16.54.112   QB-Site-1       # NorthSydney
Want to eliminate all localhost entries? Add a localhost elimination pattern:
sun9999/user$ sort -t . -k 1,1n -k 2,2n -k 3,3n -k 4,4n /etc/hosts | awk '$1!~/:/ && !/^$/ && !/^#/ && !/localhost/'
201.14.24.17    BT-Site-1       # LasPalmas
201.14.24.21    DL-Site-1       # LasPalmas
201.14.24.28    DL-Site-2       # LasPalmas
202.135.192.97  QB-Site-1       # NorthSydney
203.16.54.18    PR-Site-1       # NorthSydney
203.16.54.22    KP-Site-1       # NorthSydney
203.16.54.112   QB-Site-1       # NorthSydney
Need to print only the host name, sorted by IP Address, for entries managed by NorthSydney NOC?
sun9999/user$ sort -t . -k 1,1n -k 2,2n -k 3,3n -k 4,4n /etc/hosts | 
awk '$1!~/:/ && !/^$/ && !/^#/ && !/localhost/ && /NorthSydney/ { 
print $2 }'
QB-Site-1
PR-Site-1
KP-Site-1
QB-Site-1


If you are not using POSIX commands to do standard network management work, you don't know what you are missing!

Friday, February 18, 2011

EMC Ionix: Integration Basics (part 2)


EMC Ionix: Integration Basics (part 2)

Abstract:
Higher level integrations to network management frameworks are normally facilitated through command line processes. SMARTS, the producer a product called InCharge, which was a market leader in event correlation, was later purchased by EMC, and consolidated the product into Ionix framework. In the EMC Ionix framework, a higher level enterprise management system integration utility ("sm_ems") simplifies integration.

Integration Point:
The Managers, Open Integration, and Service Assurance Manager can be integrated to via the following commands:
  • sm_ems
    Performs individual queries and updates to a manager or manager-of-managers
The sm_ems can be leveraged to perform basic interfacing through external languages.

SM_EMS:
The "sm_ems" command offers the following options:

SparcSolaris/User777$ sm_ems --help
[No write since last change]
Usage: sm_ems [options...] [command]
Options:

--server=[name] The name of the server. Also -s.
--broker=[location] Alternate Broker location as host:port.
--system=[nameOrAddr]
Specify the name or IP address of the system this alarm is associated
with. The event will automatically be associated with this system in
the ICOI topology. The system name is canonicalized using host
name lookups. If the system does not exist in the topology it may
be created automatically if the -create-system option is specified.
Also -t.
--create-system
Indicates that the system should automatically be created if it does
not exist in the topology. The class defaults to Node, or use the
--element-class option to specify the class name.
Also -c.
--element-class=[className]
Class name to be used if the system specified by --system
option is not found in the InCharge topology and --create-system
is specified.
Also -e .
--element-name=[InstanceName]
Instance name to be used with --element-class option
Options provided with --element-class and --element-name will be used
to create the object. --system should not be used if --element-class and
--element-name are mentioned.
is specified.
Also -v .
--create-element
Indicates that the element-class and element-name should automatically
be created if it does not exist in the topology.
Also -C.
--aggregate-element-class=[className]
Aggregate Event Class name to be used if you want to generate an Aggregate
Also -E .
--aggregate-element-name=[InstanceName]
Aggregate Instance name to be used with --aggregate-element-class option
Using --aggregate-element-class and --aggregate-element-name Aggregate Event
will be created.
Also -V .
--aggregate-event-name=[aggregate Event Name]
Aggregate Event name to be used if you want to generate an Aggregate
Also -g .
--audit=[msg]
Optional text to include in the description field of the
audit log entry created for the action. Note that this
option is ignored for the add-audit-log command.
Also -a.
--traceServer Enable tracing of server communications.
--source-event-type=[eventType]
Optional source event type for notification. If not specified, no source event type will be passed in the notify() call, which will result in the server inserting
a default value (typically "UNKNOWN") into the SourceEventType attribute.
This option only works with a server newer than 6.2-SP2.

Commands:
notify [class] [name] [event] [src] [type] [clear-mode] [[attr]=[val] ...]
Notify an occurrence of the notification identified by
[class] [name] and [event].

[src] indicates the name of the application
generating the notification. Note that a subsequent
invocation to clear this notification must specify
the same value for [src]

[type] indicates the nature of the event and it
must have the value 'momentary' or 'durable'. A
momentary event has meaning only at a specific point
in time; it has no duration. An authentication failure
event is a good example. A durable event has a duration
over which the event is active and after which the
event is no longer active. An example of a durable
event is a link failure.

[clear-mode] indicates the mechanism by which the event
will be cleared. This parameter is ignored when the
type is discrete. The value 'source' indicates that
the notification will be cleared automatically by the
source when the event goes away. A value of [n]
indicates that the notification should expire in [n]
seconds. A value of 'none' indicates that the notification
should not expire and that the source will not generate
a clear event; this implies that the actual duration of
the occurrence will not be known. In this case the
system clears the event when it is acknowledged.

[attr]=[val] ... are optional attribute/value
pairs where [attr] is the attribute name and
[val] is the value. These parameters may be used
to set additional attribute values for the notification
object.

update [class] [name] [event] [attr]=[value]
Update one or more the attributes of an event.

clear [class] [name] [event] [src]
Clear an occurrence of the notification identified by
[class], [name], and [event]. [source]
indicates the name of the application generating
the clear.
assign [class] [name] [event] [owner]
Assign ownership of the notification identified by
[class], [name], and [event] to [owner].

release [class] [name] [event]
Release ownership of the notification identified by
[class], [name], and [event]. The caller
must be the owner of the notification.

acknowledge [class] [name] [event]
Acknowledge the notification identified by
[class], [name], and [event]. The
caller must be the owner of the notification in
order to acknowledge it.

unacknowledge [class] [name] [event] [owner]
Unacknowledge the notification identified by
[class], [name], and [event]. The
caller must be the owner of the notification in
order to unacknowledge it.

add-audit-log [class] [instance] [event] [message]
Add a user note containing [message] to the audit
log for the notification identified by [class]
[instance], and [event]. Note that the --audit will
be ignored for this option.

print [class] [name] [event]
Print the properties including the audit log for the
notification identified by [class] [name] and [event].

summarize [NL name]
Print a summary of all notifications of
all NL events


Standard Options:
--help Print help and exit.
--version Print program version and exit.
--daemon Run process as a daemon.
--logname=[name] Use [name] to identify sender in the system log.
Default: The program's name.
--loglevel=[level] Minimum system logging level. Default: Error.
--errlevel=[level] Minimum error printing level. Default: Warning.
--tracelevel=[level] Minimum stack trace level. Default: Fatal.
[level]: One of None, Emergency, Alert,
Critical, Error, Warning, Notice, Informational,
or Debug. Fatal is a synonym for Critical.
--facility=[facility] Non-Windows only. A case-insensitive string which
identifies the facility to use for syslog messages.
[facility]: One of Cron, Daemon, Kern, Local0-Local7,
Lpr, Mail, News, Uucp, User. Default: Daemon.
--output[=[file]] Redirect server output (stdout and stderr). The
file name is [file], or the --logname value if
[file] is omitted. Log files are always placed
in $SM_LOGFILES or $SM_WRITEABLE/logs.
--accept=[host-list] Accept connections only from hosts on
[host-list], a comma-separated list of host
names and IP addresses. --accept=any allows
any host to connect. Default: --accept=any.
--useif=[ip-address] Use this IP address as the source/destination
interface address for SNMP and ICMP packets.
-- Stop scanning for options.
For more information:
file:/opt/InCharge7/SAM/smarts/doc/html/usage/index.html
http://www.EMC.com/

One of the most powerful options from the "sm_ems" command is "summarize", to quickly review notifications from a manager.

SparcSolaris/user777$ sm_ems --server=SAM-27 summarize ALL_NOTIFICATIONS

ClassDisplayName = Router
InstanceDisplayName = ABC_CUAUHTEMOC99
EventDisplayName = Down
Active = TRUE
Acknowledged = FALSE
Category = Availability
TroubleTicketID =
Owner =

ClassDisplayName = Interface
InstanceDisplayName = IF-ABC_CUAUHTEMOC99/106 [VoiceEncapPeer20018]
EventDisplayName = Down
Active = TRUE
Acknowledged = FALSE
Category = Availability
TroubleTicketID =
Owner =
...

Note, in the output above, there are two identified types of records:
  • Interface Record
    The Interface Record can be identified through the "IF-" prefix on the display name, assigned to the Interface class, and suffixed with a "/#".
    (The "#" represents an ifIndex for the interface through SNMP and can change on the device during a reboot or other type of reconfiguration - Ionix will only recognize this after a re-discovery.)
  • Device Record
    The Device Record can be identified through not having a prefix with a "-" on it and can be noted that this is also a Router class.
For simplicity, the devices are always prefixed when loaded into smarts with "ABC_ in the above example.

The output of the "sm_ems" command can easily be parsed in POSIX awk for extracts, integrity checks with external systems, and feed external management systems.

An example follows to parse Device up/down types of events using the "sm_ems" command where the host name prefix is "ABC_":
SparcSolaris/User777$
sm_ems --server=SAM-27 summarize ALL_NOTIFICATIONS | nawk '
BEGIN { Pattern="%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\n" }
# clear vars on new record
/^Class/ { Class="" ; Inst=""; Event=""; Active="";
Ack=""; Cat=""; TT=""; Owner="" ; Tag="" }
# read record
/^Class/ { Class=$3 }
/^Insta/ { Inst=$0 ; gsub("InstanceDisplayName = ","",Inst) }
/^Event/ { Event=$3 }
/^Activ/ { Active=$3 }
/^Ackno/ { Ack=$3 }
/^Categ/ { Cat=$3 }
/^Troub/ { TT=$3 ; gsub("TroubleTicketID = ","",TT) }
/^Owner/ { Owner=$3 }
# tag interesting records
/^Insta/ && $3~/^HDB_/ { Tag="Yes" }
# print interesting record in columns
/^Owner/ && Tag=="Yes" { printf Pattern,Class,Inst,Event,Active,Ack,Cat,TT,Owner }'

Node ABC_ANEA03_ID Down FALSE TRUE Availability AR000000003967636 SYSTEM
Node ABC_ANVW04_ID Down FALSE TRUE Availability AR000000003968578 SYSTEM
Node ABC_ANSM12_BR Down FALSE TRUE Availability AR000000003968469 SYSTEM
...


The beauty of "nawk", in conjunction with "sm_ems" is the simple capacity to move from reporting to interfacing to foreign Ionix systems.

To replicate the notifications from a source SAM to a destination SAM, a couple more nawk statements are all that is required, print out the command, and pipe it to a shell.

Conclusion:
The use of the "sm_ems" allows for a simple integration point into Ionix for reporting and can also facilitate the movement of notifications to foreign systems with standard POSIX commands like "awk".

Wednesday, February 16, 2011

EMC Ionix: Architecture and Integration Basics


EMC Ionix: Architecture and Integration Basics

Abstract:
Network Management platforms perform monitoring, auditing, and management work of computing infrastructure. Most network management platforms target a particular aspect of management: Fault, Performance, or Configuration. SMARTS produced a fault managegment product suite called InCharge, which was later purchased by EMC and branded as Ionix - based upon the phrase "keep your eye on it". Integration into EMC Ionix is straight forward, leveraging a couple of basic command.


Architecture:

The Ionix infrastructure is based upon a publish-subscribe system. Individual Managers (i.e. Availability Manager [AM], MPLS Manager, etc.) perform polling of devices and publish the results, Adapters (SNMP Trap, Syslog, etc.) perform simple gathering of information from foreign systems, Open Integration [OI] consolidates information from multiple adapters and publishes the information, and a Manager of Managers called Service Assurance Manager [SAM] subscribes to information from them all. A broker tracks all components.

Integration Points:

The Managers, Open Integration, and Service Assurance Manager can be integrated to via the following commands:
  • dmctl
    Performs individual queries and updates to a manager or manager-of-managers
  • sm_adapter
    Subscribes or publishes to a manager or manager-of-manager
The dmctl can be leveraged to perform basic interfacing through external languages and even perform some subscription or publishing work.

The sm_adapter a native mechanism to perform advanced interfacing through the proprietary internal language called "asl" scripting.

The "asl" scripting is out of scope of this article.

DMCTL:

The DMCTL interface offers the following options:
SparcSolaris/User$ dmctl
Domain Manager Control Program (V7.2.0.1) -- Type 'help' for a list of commands.
dmctl> help

Commands:
attach [domain]
clear [class::instance::event]
create [class]::[instance]
consistencyUpdate
correlate
delete [class]::[instance]
detach
execute [program] [[arg1] ...]
findInstances [class-regexp]::[instance-regexp]
get [class]::[instance][::[property]]
getClasses
getEvents [class]
getEventDescription [class]::[event]
getInstances [[class]]
getModels
getOperations [class]
getPrograms
getProperties [class]
getThreads
insert [class]::[instance]::[property] [value]
invoke [class]::[instance] [op] [[arg1] ...]
loadModel [model]
loadProgram [program]
notify [class::instance::event]
ping
put [class]::[instance]::[property] [value1] [[value2] ...]
quit
remove [class]::[instance]::[property] [value]
restore [file]
shutdown
status
save [file] [[class]]
To attach to a manager, like a SAM:
SparcSolaris/User$ dmctl
Domain Manager Control Program (V7.2.0.1) -- Type 'help' for a list of commands.
dmctl> attach SAM-03
Server SAM-03 User: admin
admin's Password: XXXXXXXXXX
Attached to 'SAM-03'

To retrieve basic notification instances from a SAM:
dmctl> getInstances ICS_Notification
NOTIFICATION-Host_ABC__ABLD25__BR_Down
NOTIFICATION-Host_ABC__ACAQ04__ID_Down
NOTIFICATION-Host_ABC__ACAQ07__ID_Down
NOTIFICATION-Host_ABC__ACAQ08__ID_Down
NOTIFICATION-Host_ABC__ACBC01__BR_Down
Note, the above example, the underscore "_" is the field separator. The underscore is escaped using double underscores. The retrieved instance is formatted with the following characteristics:
Notification-{Device-Class}_{Device-Host-Name}_{Event}
This was a simple event notification. The device could be extended with an additional set of flas to uniquely define a managed resource, but this is beyond the scope of this article.

To subscribe to a live stream of events from a SAM using dmctl:
SparcSolaris/User$ dmctl -s SAM-03 subscribe .*::.*::.*
Server SAM-03 User: admin
admin's Password: XXXXXXXXXX
1297883020 Wed Feb 16 14:03:40 2011 NOTIFY ICS_Notification::NOTIFICATION-Host_ABC__ACDB05__ID_Down::RootNotification 1.00
1297880934 Wed Feb 16 13:28:54 2011 NOTIFY ICS_Notification::NOTIFICATION-Host_ABC__ANVR02__BR_Down::RootNotification 1.00
1297880633 Wed Feb 16 13:23:53 2011 NOTIFY ICS_Notification::NOTIFICATION-Host_ABC__ANND02__ID_Down::RootNotification 1.00
1297880934 Wed Feb 16 13:28:54 2011 NOTIFY ICS_Notification::NOTIFICATION-Host_ABC__ANHS04__ID_Down::RootNotification 1.00
All the properties of an event can be retrieved via dmctl:
SparcSolaris/User$ dmctl -s SAM-03 get ICS_Notification::NOTIFICATION-Host_ABC__ACDB05__ID_Down
Server SAM-03 User: admin
admin's Password: XXXXXXXXXX

Properties of ICS_Notification::NOTIFICATION-Host_ABC__ACDB05__ID_Down:
Acknowledged = FALSE
AcknowledgmentTime = 0
Active = TRUE
AggregatedBy = { }
Aggregates = { }
AuditTrail = {
{
22
1297883024
SYSTEM
Action completed successfully...
Remedy-AutoOpen-Ticket
}
...

Subscribing to an Open Integration manager is also possible:
SparcSolaris/User$ echo "" | dmctl -s OI-30 subscribe .*::.*::.*
1297891133 Wed Feb 16 16:18:53 2011 NOTIFY ICS_Notification::NOTIFICATION-Host_ABC__ACSH02__BR_Down::RootNotification 1.00
1297891133 Wed Feb 16 16:18:53 2011 NOTIFY ICS_Notification::NOTIFICATION-Host_ABC__ACBI06__BR_Down::RootNotification 1.00
1297891133 Wed Feb 16 16:18:53 2011 NOTIFY ICS_Notification::NOTIFICATION-Host_ABC__ANMZ03__BR_Down::RootNotification 1.00

Subscribing to an Open Integration manager for a complete details is also possible with some nawk glue:
SparcSolaris/User$ echo "" | dmctl -s OI-30 subscribe .*::.*::.* |
nawk 'NF==8 || NF==9 { gsub("::"," ") ; print "get " $8 "::" $9 }' |
dmctl -s OI-30
Domain Manager Control Program (V7.2.0.1) -- Type 'help' for a list of commands.
Attached to 'OI-30'
dmctl>
Properties of ICS_Notification::NOTIFICATION-Host_HDB__ACSH02__BR1_Down:
Acknowledged = FALSE
AcknowledgmentTime = 0
Active = TRUE
AggregatedBy = { }
Aggregates = { }
AuditTrail = {
...
SM_ADAPTER

The sm_adapter command has variety of options:
SparcSolaris/User$ sm_adapter --help 
Usage: sm_adapter [options...] [[rule-set]]
Arguments:
* [rule-set] ASL rules file.

Options:
--broker=[location] Alternate Broker location as host:port.
Also -b [location].
--model=[model] Name of model library to load. Also -M [model].
--dynamic Load dynamic model files.
--name=[name] Start a server registered under [name].
Also -n [name].
--port=[port] Alternate registration port. Use with --name.
--timeout=[secs] Set the timeout for server interaction. The
timeout applies to the back-end connection
except when using the subscriber front end, in
which case it applies to the front end. The
argument is in seconds, and can be a decimal
value. If the --timeout option appears with no
value, 600 seconds is used. By default, there
is no timeout.
--wait Wait for initial driver to complete.

Rule-Set Options:
-D[var]=[value] Override value for a rule set variable.
--verify Validate rules only.

Front-End Options:
--file=[path] Read input from a file. Also -f [path].
--tail=[path] Read input by tailing a file from the current
position. Also -t [path].
--tailFromStart=[path] Read input by tailing a file from the beginning.
--program=[cmd] Read input from a command pipeline. Also -p [cmd].
--field-separator=[c] Translate 'C' to the field separator (FS) marker.
Valid only in conjunction with --file, --tail or
--program. Also -F [c].
--subscribe=[sub] Use the subscriber front-end. Subscriptions
are sent to the server specified with the
--server option. The [sub] parameter is the
subscription request.

If [sub] is 'topology' a subscription for
topology changes is requested.

If [sub] is of the form '[name]/n' then
a subscription to NL [name] is requested.
Note that only one NL subscription may be
specified.

If [sub] is of the form
C::I::E[/paev], 'C', 'I', 'E' are regexp
patterns representing the classes, instances,
and events to which to subscribe. The letters
following a slash (/) are subscription qualifiers:
'p' means subscribe to problems; 'a' means
subscribe to aggregates (impacts); and 'e' means
subscribe to events. If none of these are
present, 'p' is assumed. 'v' means run in
verbose mode, which turns on subscription
control messages.

Otherwise, [sub] is a profile name; that profile
specifies what subscriptions are to be requested.
A profile name may optionally be followed by the
/v qualifier.

Multiple --subscribe options can be specified.

--subscribeProp=[sub] Subscribe to property changes.
[sub] is of the form C::I::P[/v], 'C', 'I', 'P'
are regexp patterns representing the classes,
instances,and properties to which to subscribe.
The patterns are optionally followed by the /v
qualifier which, turns on the subscription
of the control messages too.

Multiple --subscribeProp options can be specified.

--smoothing=[num] Event smoothing interval. This parameter is
used by the subscriber front-end to smooth
event notifications (and clears) received
from the server. Only events (or clears) that
stay active (or cleared) for [num] seconds
are fed into the input stream. [num] must be a
non-negative integer. The default value is 0
which disables smoothing.
--ignoreOld Ignore old notifications. This parameter is
used by the subscriber front-end. Notifications
for events that were active at the before this
adapter connected are not fed to the input
stream.

Back-End (Server) Options:
[--server=self] Connect driver to local repository; the
default.
--server=null Do not connect to any server. Useful for
debugging offline in combination with
--traceServer.
--server=[name] Connect driver to remote server.
Also -s [name].
--rserver=[name] Auto-reconnect driver to remote server.
Also -S [name].
--description=[desc] Description of this adapter;
sent to remote server.
--mcast=[name] Connect driver to a local subscription server.

Trace Options:
--traceRules Trace rule compilation.
--traceServer Trace interactions with the back-end server.
--traceParse Trace rule matching.
--trace Enable all tracing. Also -d.

Standard Options:
--help Print help and exit.
--version Print program version and exit.
--daemon Run process as a daemon.
--logname=[name] Use [name] to identify sender in the system log.
Default: The program's name.
--loglevel=[level] Minimum system logging level. Default: Error.
--errlevel=[level] Minimum error printing level. Default: Warning.
--tracelevel=[level] Minimum stack trace level. Default: Fatal.
[level]: One of None, Emergency, Alert,
Critical, Error, Warning, Notice, Informational,
or Debug. Fatal is a synonym for Critical.
--facility=[facility] Non-Windows only. A case-insensitive string which
identifies the facility to use for syslog messages.
[facility]: One of Cron, Daemon, Kern, Local0-Local7,
Lpr, Mail, News, Uucp, User. Default: Daemon.
--output[=[file]] Redirect server output (stdout and stderr). The
file name is [file], or the --logname value if
[file] is omitted. Log files are always placed
in $SM_LOGFILES or $SM_WRITEABLE/logs.
--accept=[host-list] Accept connections only from hosts on
[host-list], a comma-separated list of host
names and IP addresses. --accept=any allows
any host to connect. Default: --accept=any.
--useif=[ip-address>] Use this IP address as the source/destination
interface address for SNMP and ICMP packets.
-- Stop scanning for options.
For more information:
file:/opt/InCharge7/SAM/smarts/doc/html/usage/index.html
http://www.EMC.com/

A notification list can be defined in an OI or a SAM for individual gui's to subscribe to. Notification lists can also be subscribed to via the sm_adapter:
SparcSolaris/User$ echo "" | sm_adapter -s OI-30 --subscribe='ALL_NOTIFICATIONS/n' 
1295993287|CONNECT|OI-30|
1295993287|NL_CHANGE|Host|ABC_ACDI69_BR|Down|ID_2C?aPBE|
1295959726|NL_NOTIFY|Host|ABC_ANKP07_ID|Down|ID_lO(G:BE|
1295988119|NL_NOTIFY|Host|ABC_ACBG04_ID|Down|ID_2C?aPBE|

Note, with the sm_adapter output, the information can be parsed using the vertical pipe "|".

The sm_adapter can run individual "asl" script to perform the parsing in real time, but that is beyond the scope of this article.

Conclusion:

Integrating into Managed Service Provider frameworks for Network Management such as EMC Ionix is fairly straight forward and can be done by competent staff with POSIX scripting capabilities.