view · edit · history · print

So you need help hey?

AIX Workload Manager - Quick Reference

wlmcntrl [[-a | -p] [-c] [-g] [-d ConfigDir]] [-o | -q]
wlmcntrl -u [-S Superclass | -d ConfigDir]
wlmcntrl -T [class | proc]
  -T Disables total limits (AIX5.2).
  -c Active for CPU, passive for Memory and Disk I/O.
  -a Start.
  -p Passive.
  -g Disables enforcement of resource set bindings.
  -d ConfigDir Use config withouth /etc/wlm/current link.
  -o Stop.
  -u Update (-S AIX5.1).
  -q Query state 
     (Returncode: 0 for active, 1 for stopped, 2 for passive)

Network Analyse

with iptrace (detailed traces)


-a exclude arp
-s source host
-d destination host
-p protocol


$startsrc -s iptrace -a "-i en1 /tmp/log1.out"
$stopsrc -s iptrace
$ipreport -ns /tmp/log1.out > /tmp/log1.formated

with tcpdump (quickly writing filters)

-n No resolving (numeric) of internet adresses. 
   Use this, unless you have written a good filter with limmited output!
-i Interface, name as shown in ifconfig.
-I don't wait until buffer fill-up, imediate output.
-p don't use promiscuous mode, use it if not needed.
-q quiet, less output.

filter keywords: and not ; ip ; not arp ; host ; net 10.66.192

Undocumented features

What is the current AIX Level?

$ oslevel

$ oslevel -r

$ oslevel -s

Note: after AIX53 ML3 Maintenance Levels are no longer the correct naming - read aix service strategy (link dead?). Technoligy Levels, Service Packs, etc... are now the correct terminology.

In what LPAR is this OS running?

$ uname -L # "AIX -1 NULL" Means there are no LPAR's (1 OS on 1 box).

What is the systems adress space (32 of 64 bit)?

$bootinfo -y # Hardware platform capability 
$bootinfo -K # Current Kernel adress space 

Tip: Je krijgt deze opties NIET te zien via de man pages maar sms wel als je een ongeldige optie of optie --help megeeft aan het commando!!!

Set up ksh for emacs mode command line editing:

Tip from: scotte@cdsac.uucp (L. Scott Emmons)

The ksh has an undocumented way of binding the arrowkeys to the emacs line editing commands. In your .kshrc, add:

alias __A=^P
alias __B=^N
alias __C=^F
alias __D=^B
alias __H=^A

Note that "^P" (et al) must be the actual control sequence.

Type "set -o emacs" or put this line in your .profile.

Also, you MUST have PTF U406855 for this to work in AIX 3.2. The APAR # for the problem is IX25982, which may have been superseded.

Restore from mksysb

Manipulations for restoring a single file:

cd / 
tctl -f /dev/rmt0 rewind 
tctl -f /dev/rmt0.1 fsf 3 
chdev -l rmt0 -a block_size=0 
restore -xqf /dev/rmt0.1 -s 1 ./usr/bin/vi 
or for a file table: 
restore -Tqvf /dev/rmt0.1 

Manipulations for restoring without Preserving Mirrors

Create an mksysb withouth mirror definitions:

  • mkszfile (for generating
  • edit COPIES, LPs and PP entries in
  • mksysb (zonder -i flag)

Unmirror an existing mksysb with mirror definitions:

$ mkdir /tmp/newdata ; cd /tmp/newdata 
$ chdev -l rmt0 -a block_size=512 ; tctl -f /dev/rmt0 rewind 
$ restore -s2 -xqvf /dev/rmt0.1 ./ 
# edit COPIES, LPs and PP entries in 
$ echo data > signature 
$ find . -print | backup -iqvf /dev/rfd0 # or fda0 instead of rfd0 
$ restore -Tqvf /dev/rfd0 # to check the backup 

NOTE: Now use the normal restore procedure but with floppy in drive

AIX packaging

  • lslpp -f "package" # results in filelist
  • lslpp -w "/path/file" # results in package name that contains the file
  • lslpp -L "package" # results in package version
  • lppchk # verify files of installed software
  • instfix -ik IY5400 # check for APAR complience
  • instfix -ic | grep :-: # check for downlevel packages

Power Management

Power Management is iets voor thuis - een feature die je opzet omdat je vrouw van haar oren maakt dat die "bak" een hele dag voor niets staat te draaien. Op het werk moet z'n ding werken (of op z'n minst klaar staan om te presteren) - zet dit dus af!!

# Voor het scherm alleen:
$x() {pmctrl -d lft0 -t $1 $2 $3}; x  '0' '0' '0'

# Dit willen we dus niet en we zetten het spel volledig af!
$vi /etc/inittab # and comment with ":"
:pmd:2:wait:/usr/bin/pmd > /dev/console 2>&1 # Start PM daemon
$reboot -Fr

# The display still goes blank, 
# even when i don't start a Desktop and only launch X!
$xset s off # from an xterm!!!

Get your Systems Microcode

$ lscfg  -vp |  grep  alterable
ROM Level.(alterable.ct020822 
= Service Processor FirmWare level (or SvP FW)

ROM Level.(alterable.CLT02219
= System FirmWare Level (or Sys FW)

# or use this command and be astonished
$ lsmcode -A        

change errpt template

Create a list with Software Errors you want to ignore in /tmp/errchange.lst:





$errupdate /tmp/errchange.lst

Alternate Disk Install

$ alt_disk_install -C -O <hdisk> # dont copy ODM (network config)
$ alt_disk_install -W <hdisk> # wake-up
$ alt_disk_install -S # sleep
$ alt_disk_install -X [VG] # clean-up

NB: never use import / export on altinst images!

System Resource Controller

Generic Control: lssrc -a ; stopsrc -s <service> ; startsrc -s <service>

Example to add a service: mkssys -p /tmp/ -u 0 -s nisguard -S -n 15 -f 9

Related Information: The auditpr command, chssys command, lssrc command, refresh command, rmssys command, startsrc command, stopsrc command, traceson command, tracesoff command.

Library Usage on AIX

  • genkld : list of shared objects currently loaded onto the system (AIX)
  • slibclean : removes any currently unused modules in kernel and library memory (AIX)
  • ldd : display link dependencies (3th party tool from Bull package
  • cd dir; fuser -dcxV; cd dir; fuser -Vcux libC.a # can also help

ODM changes

Standard method to make changes in ODM see this example: Remove duplicate ODM entry's:

odmget -q "attribute=modelname" PdAt > /tmp/odm1.out
odmget -q "uniquetype=sys/node/chrp" PdAt > /tmp/odm2.out
vi /tmp/odm1.out # verwijder alle dubbels
vi /tmp/odm2.out # verwijder alle dubbels
odmdelete -o PdAt -q "attribute=modelname"
odmdelete -o PdAt -q "uniquetype=sys/node/chrp"
odmadd /tmp/odm1.out
odmadd /tmp/odm2.out

mysql query output

export PATH=$PATH:/opt/freeware/mysql/bin 
export PATH=$PATH:/opt/mysql/product/current/bin
mysql -u test -p DBname pa$$=test

now start selecting... select ... from ... where ... like "...%" and is not ... and not like "" structure hint: show databases; show tables; describe Hardware;

To submit your query and store results, use these sollutions:

  • echo 'select ...' | mysql -u test -p DBname
  • in mysql shell type @tee /path/filename @@

output options for mysql:

  • option -t ASCII tables
  • option -X XML output
  • option -H HTML output

Playing [or fighting] with mountpoints

Know this one?

./..: Permission denied

What it means?

No rights on the mountpoint!

Want proof?

Here is a testcase:

$su - root
$chown root.root /dir/mountpoint; 
$chmod 700 /dir/mountpoint
$mount /dev/sommefs /dir/mountpoint

$su - normal_user
# these all work fine
$ls /dir
$ls /dir/mountpoint
$ls /dir/mountpoint/sommefs_dir
$cd /dir/mountpoint
$ls /dir/mountpoint
# now, this one WILL FAIL
$ls -ld ../mountpoint
./..: Permission denied
# even better, watch this, and see NOTHING!
$ls -la | grep "\.\."

Correcting it withouth unmounting ;-)

$su - root
$mkdir /dummydir
$mount / /dummydir
$chmod 755 /dummydir/dir/mountpoint
$umount /dummydir

$su - normal_user
$cd /dir/mountpoint
# all results okay now..
$ls -ld ../mountpoint
drwxr-xr-x   17 root root 4096 May 21  2001 ../mountpoint/
$ls -la | grep "\.\."
drwxr-xr-x   17 root root 4096 Jul 14 09:14 ../

HACMP status

Een eenvoudige manier om te weten wat op welk systeem actief is (HACMP ES) /usr/es/sbin/cluster/utilities/clfindres


> root@sbaka: > /usr/es/sbin/cluster/utilities/clfindres
> GroupName       Type       State    Location   Sticky Loc
> -----------   ----------   ------   --------   ----------
> CBAIFSMQB_D   cascading      UP     sbaka
> CBAIFSMQB_R   cascading      UP     sbaka

Controle op Cluster configfouten: smitty clverify

Creating CD's for AIX

You want to create a CD with those long filenames like: Transfer all files to a "temp" AIX directory..

inutoc . # in the "temp" dir.
cd .. 
mkisofs -o myimage.iso -R temp voilą, an image you can write with your favorite CD writer - which can be on a PC if you tranfer the ISO back.

Why this workaround?

AIX is using the standard ISO CD format and adheres to the 'Rock-Ridge' extensions to support long filenames, etc. This is what all Unix machines do. Unfortunately Microsoft decided that it needs its own CD format and invented 'Joliet'. Most PC software only supports 'Joliet' and not Rock-Ridge, Nero is no exception.

However, there is an excellent workaround: The 'mkisofs' utility takes your files and creates a CD-image (.iso) including the Rock-Ridge table of contents. You can then write the iso file to your CD. Just search for mkisofs and start fiddling with its commandline-switches.

Environment Status

$ /usr/lpp/diagnostics/bin/uesensor -l

For p650 and p670 this seems to be a problem, see pmr84186 (see also [1] [2]) - IBM tells us that the SP will handle this all by itself! One thing is shure, if you want to try this on a partitioned system you need resource group_128!


  • the best range is between 15-32°C (=60-90°F),
  • acceptable rage is 10-40°C (=50-104°F).

Get HMC Version and Release on the command line

IBM says "it can't be done", i say it can:

rpm -qi IBMhsc.coreserver

Lately you can also use the following command:

lshmc -V

Network Time Protocol

  • Time server = ntp-server
  • Master server = ntp-server-master

Check progress and internal counters on time server

ntpq> peers
     remote           refid ...   offset    disp
 LOCAL(0)        LOCAL(0)   ...    0.000   10.01
*ntp-server-mast .hopf.     ...    4.252    0.84

check client systems withouth time server deamon

ntptrace ntp-server
  stratum 2, 
  offset 3.198518, 
  synch distance 0.01930
  stratum 1, 
  offset 3.201811, 
  synch distance 0.00974, 
  refid 'hopf'

The scripts for starting ntp:

rc.01.ntp   # uses ntpdate, scheduled daily
rc.01.ntpd  # uses xntpd for constand syncing

Writing files >2GB?

  • To get your user limits, type: `ulimit -a`.
  • To get filesystem limits, type: `lsfs -q /some/filesystem`,
on the last line you will see something like "bf: true/false",
true = big file filesystem, false = normal filesystem.

Note: This cannot be changed on existing JFS filesystems.

doing NFS on the AIX CLI

# set host in /etc/hosts 
# add line to /etc/exports 
# example: /tmp/writeme -root=host1:host2:,access=host1:host2: 
# example: /cdrom -ro 
$ exportfs /cdrom 
$ exportfs -v 
$ showmount -e 
$ startsrc -g nfs 
$ mount -v nfs -o ro serv:/cdrom /mnt 
$ exportfs -u /cdrom ; AND remove /cdrom line from /etc/exports 

Converting between: dec, hex and binary with bc

Example (dec.12=hex.C):

$ bc

Example (dec.3=bin.11):

$ echo 'obase=2;3' | bc

Example (hex.12=bin.10010)

$ bc

Hunting down the process that keeps my shared memory in use

  • verify 'svmon' is installed on your system
$lslpp -l
  • Use 'ipcs -ma' command to obtain Shared Memory ID. Note this number is in decimal and needs to be converted into hex.
  • Use kdb (kernel debugger) to locate segment ID. Extra care should be taken when using kdb on a live system.

IPC info

Select the display:

1) Message Queues
2) Shared Memory
3) Semaphores
Enter your choice: 2
1) all shmid_ds
2) select shmid_ds
Enter your choice: 2
Shared Memory id (in hex): **input Shared Memory ID**

  • while still in kdb, locate 'shm_handle' value. Write it down. This is the Segment ID.
  • quit kdb with 'q' subcommand.
  • locate process(s) attached to segment with the svmon command:
$svmon -S <SegmentID> -l

IBM wants a "snap"

  • delete the old snap => snap -r
  • software calls => snap -ac
  • hardware call => snap -gbc
  • hacmp calls => snap -ec
  • snap file => /tmp/ibmsuppt/snap.pax.Z


  • use -d option for alternate locations then /tmp/ibmsuppt.
  • ftp upload to emea server ( ).
  • snap -a also includes the latest system dump, see sysdumpdev -L.

What is the precentage downtime in real live units

95%  = 438 uur/jaar  = 37 uur/maand 
98%  = 175 uur/jaar  = 15 uur/maand 
99%  = 88 uur/jaar  = 7 uur/maand 
99.9%  = 9 uur/jaar  = 44 min/maand 
99.99%  = 52 min/jaar  = 5 min/maand 
99.999%  = 5 min/jaar  = 26 sec/maand 
99.9999%  = 31 sec/jaar  = 3 sec/maand 

Major/Minor number after crash or JFS corruption

In the errpt you can [sometimes] find a major/minor number. These are in hex and have to be converted to decimal. Use the decimal notation to find the device (lv) and identify on which filesystem the corruption is located.

  • ls -lR /dev | grep [major_in_decimal] | grep [minor_in_decimal]
  • lslv (or another appropiate command to investigate the device) ...


0032 0004

32hex = 50dec
5hex  = 4dec

$ ls -lR /dev | grep 50 | grep 4
crw-rw-rw-   1 root     system       50,  4 Apr 14 11:12 vol018

$ lslv vol018
mount point: /sbepaakb/oracle/thadbexp/db/dbf

Check file permissions with find (TCB related)

$ ls -l ssh_conf*
-r--r--r-- 1 root system 1739 Apr  5 2004  ssh_config
-r--r--r-- 1 root system 1739 Apr  5 2004  ssh_config.bak

# Ah 2 files with the same permissions...

$ find . -perm 444 -ls
16769 4 -r--r--r-- 1 root system 1739 Apr  5  2004 ./ssh_config.bak

# only 1 file? I expected 2 files?

$ ls -el ssh_conf*
-r--r--r--+ 1 root system 1739 Apr  5 2004  ssh_config
-r--r--r--- 1 root system 1739 Apr  5 2004  ssh_config.bak

# Aha the "-e" option reaveales a "+" sign => extended ACL!

$ aclget ssh_config
base permissions
    owner(root):  r--
    group(system):  r--
    others:  r--
extended permissions

# no! TCB maybe?

$ chtcb query ssh_config
ssh_config is in the TCB

# Ah yes...

$ find . -perm 100000444 -ls
16758 4 -r--r--r-- 1 root system 1739 Apr  5  2004 ./ssh_config

# permission value = 100.000.000 for TCB files!

Calculate the maximum JFS size for existing filesystems

Number of bytes per inode:

NBPI * 2 ^ 24
Example: ((65536*(2^24))/1024^3) GB = 1TB

Fragment Size (in bytes):

frag.size * 2 ^ 28
Example: ((4096*(2^28))/1024^3) GB = 1TB

NBPI ranges depend on the Allocation group size:

ag=8 512, 1024, 2048, 4096, 8192, 16384
ag=16 1024, 2048, 4096, 8192, 16384, 32768
ag=32 2048, 4096, 8192, 16384, 32768, 65536
ag=64 4096, 8192, 16384, 32768, 65536, 131072

Note: For JFS2 other (more flexible) rules apply.

Recommended parameters

  • Max 68 GiB: frag size: 4096, nbpi: 4096, compress: no, bf: true, ag size: 8
  • Max 1 TiB: frag size: 4096, nbpi: 65536, compress: no, bf: true, ag size: 32

Activate an LPAR from the HMC command prompt

$ chsysstate -r lpar -o on -m <system_name> -f <profile> -n <lpar_name>


$ chsysstate -r lpar -o on -m "p650-09_sbe-aam" -f "normal" -n "p650-09AD_sbedaamd"

Change a partition profile's boot mode to normal from the HMC command prompt

$ chsyscfg -r prof -m <system_name> -p <partition> -n <profile_name> -i attribute=value


$ chsyscfg -r prof -m p650-09_sbe-aam -p p650-09AD_sbedaamd -n normal -i "boot_mode=norm"

remote mksysb transfers

Here we create an mksysb with the aide of sudo. In combination with the sudo command we use "su -", that way we have our "ulimits" and complete "root environment" available. Then we try to transfer it "secure" to a remote server where we do not have remote root login previleges but we do have sudo access. The result: my personal users file-limit is 2GB on both servers and with this method i can create AND transfer larger mksysb files in a secure environment!

sudo su - root -c "mksysb -pe /var/local/backup/mksysb/hostx.mksysb" && \
dd if=/var/local/backup/mksysb/ hostx.mksysb bs=8k | \
gzip -1 | \
ssh -x wva0331@nimmaster sudo su - root -c "dd 
of=/nim/images/hostx.mksysb.gz bs=8k" && \
sudo rm /var/local/backup/mksysb/hostx.mksysb

Note: more ssh file transfer methods can be found on our "other" wikipage, WikiLinuxCOM2.

Stream an mksysb through a FIFO buffer

mkfifo /tmp/pipe.$$ 
mksysb -ievx /tmp/pipe.$$ & 
dd if=/tmp/pipe.$$ | ssh server dd of=....

Mirror a terminal

Yes, you can do this on AIX by default. An equivalent for this is ttysnoop - but i never tested that one. Here is an example, but for the details see the man page.

# ask remote host for his/her pts by typing: tty 
# ask remote host to open a subshell: ksh
$ portmir -t pts/8 -m pts/4
portmir: Remote user connected, mirroring active.
$ portmir -o # Closes mirror (attention - remote shell will be closed!).

File, directory and link rights

If you change the groupid of a group you also have to change the files. But for links people often re-create them. If you just use the -h option there is no need for that!

# change file and directory rights ..
$ sudo find / -group 235 -exec chgrp opc {} \;

# change link rights ..
$ sudo find / -group 235 -type l -exec chgrp -h group5 {} \;

Config limits

IBM stanza files like /etc/qconfig and /etc/security/user have line lenght limit of 255char. For qconfig this means that you are limited in the number of devices per queue. The number of queues however seems to be unlimited.

The vi version included has a limit of 2048char. Use vim for editing longer lines.

The maximum number of users in /etc/group is limited to 2000. The line lenght is defined in /usr/include/grp.h. Here is the calculation 8+((8+1)*2000)+14=18022.

A NIS record has a maximum size of 1024bytes. This limit applies to all NIS maps including maps for /etc/group, /etc/netgroup, etc... While creating the dbm (make or makedbm), it uses the line along with the domainname and some other fields, a safe config line lenght is 1000char.

qconfig device names (in /etc/qconfig) are cut to 20char and get a prepending "@"-sign . If you have the hostname "config-server-aix-01" it gets cut and becomes "@config-server-aix-0"!

Logical volume Name of the logical volume. Logical volume names must be unique systemwide and can range from 1 to 15 characters.

Volume group Name of the volume group. Volume group names must be unique systemwide and can range from 1 to 15 characters.

Patch-files on AIX

$ diff -c oldfile newfile > patchfile
$ patch -ci patchfile copy-of-oldfile 
$ sum newfile oldfile copy-of-oldfile 
  40340     1 newfile 
  15765     1 oldfile 
  40340     1 copy-of-oldfile

List files with full path

$ echo $PWD/*
$ find $PWD/* -prune

Using ramdisks on AIX

What is SYSPROC?

The resource that handles/controlls processes & dumps (eg. capture process errors), starts the init process (PID 0), etc...

Start CDE desktop on AIX from text mode

$ xinit /usr/dt/bin/dtsession

NIS user rejected

If you are using NIS an the gecos contains the word "root" (eg: Bart de Groot) the user will not be mapped unless you change the /var/yp/Makefile and replace `grep -v root` to `grep -wv root` or something

Set window title

# bash
$ PROMPT_COMMAND='echo -ne "\033]0;xxxxxx\007"'

# ksh
$ print -n '\033]2;xxxxxxx\007'
$ print -n '^[]2;xxxxxxx^G'

(tested with putty en xterm settings)

Java on AIX

NB: AIX5.3 contains -by default- a 64bit java version.

Memory leaks

These are dirty but they work:

Modify an RISC System/6000 executable to support "large memory model"

Sample usage:

$ cp $(which who) ./who-copy
$ sh who-copy
Program to be zapped: who-copy
previous value:
0000100   \0 005  \0 003   1   L  \0  \0  \0  \0  \0  \0  \0  \0  \0  \0
1+0 records in
1+0 records out
new value:
0000100   \0 005  \0 003   1   L  \0  \0  \0  \0  \0  \0 200  \0  \0  \0
$ sh "/usr/sbin/*"
LMM enabled for file: /usr/sbin/fuser
LMM enabled for file: /usr/sbin/rmsock

NOTE: Use at your own risk, no guarantee!

Extra: It is possible that the following will also work instead of the zap script, but i never verrified it...

/usr/ccs/bin/ldedit -bmaxdata:0x80000000/dsa a.out

Replace hdisk

$ unmirrorvg rootvg hdisk0
$ chpv -c hdisk0
$ reducevg rootvg hdisk0
$ rmdev -dl hdisk0
$ ln /dev/rhdisk1 /dev/ipldevice
$ bosboot -ad /dev/ipldevice
$ bootlist -m normal hdisk1

Dump CHRP firmware (device table)


Download IBM Performance Tools

Link between rpm and lpp

The command enables the rpm command to recognize that the libraries have been installed using installp.


AIX build-in firewall filter

Write big file

dd if=/dev/zero of=bigf bs=1048576 count=1

Writes 1MiB file.

VIO links

SMT (POWER5 multithreading)

Q. How would I know if my system is capable of using Simultaneous Multi-threading (SMT)? A. Your system is capable of SMT if it's a POWER5-based system running AIX 5L Version 5.3.

 * smtctl
 * lparstat [-i]
 * lsattr -El $(lsdev -Cc processor | grep Available | head -n 1 | cut -d' ' -f1)
 * lsdev -Cc processor -S A (returns the actual number of physical processors) 

LVM lowlevel commands to move 1 single PP

In case of mirroring allocation problems or the need to free-up 1PP/disk to convert a VG to a BIG-VG you might need to move a single Physical Partition. There are 2 commands (AIX53) that can help you with this: migratelp and lmigratepp.

SYNTAX: (no leading zeros, copynumbers are 1 to 3)
migratelp LVname/LPartnumber[/Copynumber] DestPV[/PPartNumber]

$ migratelp movemelv/1/2 hdisk12/134

lmigratepp -g VGid \
             -p SourcePVid -n SourcePPnumber \
             -P DestinationPVid -N DestinationPPnumber

$ lmigratepp -g 00582b6a00004c000000010e514b6f61 \
             -p 00584d2a5e4d8e41 -n 0134 \
             -P 00584d2a14dfdc7e -N 0001

Note: to choose your destination PPnumber you can use the output of `lspv -M hdiskpower14`.

Undocumented low-level LVM commands

Redbook: SG24-5433-00

AIX Logical Volume Manager
from A to Z:
Troubleshooting and Commands
March 2000

Finding hotspots

Relevance of High Wait I/O

In the past, a high wait I/O was a good predictor of a bottleneck. However, today it's a bit more complicated. High wait I/O may not imply an I/O bottleneck. You'll have to consider other factors, which is listed below.

The reason high wait I/O may not be a good predictor is because CPU performance has significantly outpaced disk performance. Here's a situation that illustrates the point while replacing an older server with a new pSeries server. The new server has 6x the CPU performance (SAN storage stays the same). After the upgrade, wait I/O increases from 33% to 70% during batch jobs - the following table shows what happens.

Variable      Old Server  New Server
Rel CPU Perf  1           6
Wait I/O      33%         75%

Batch Times:
CPU Time      40 min      7 min
I/O Time      20 min      20 min
              ------      ------
Total Time    60 min      27 min

The server upgrade improved CPU performance, but not I/O performance. The faster CPU's were able to do their job faster, hence they spent a higher percentage of their time waiting for disk I/O. Since batch time decreased by half the high wait I/O isn't a real problem. If you do not have anything to compare (upgrade and historic performance data) against it is harder to show and prove this.


  • filemon disk response time reads should be under 10ms, and writes under 5 ms;
  • spread the data over more disk drives;
  • If running a database, can old data be archived and indexes rebuild?

AIX53 LDAP users management (TL5 also includes AD enhancements)

Filesystems refuse to unmount

If lsof reports nothing, fuser without parameters reports nothing, then try:

fuser -dVu /dev/somelv

rsh and the rlogin attribute

In smitty you find the following line:

 User can LOGIN REMOTELY(rsh,tn,rlogin)?

It changes the rlogin attribute

 lsuser -a rlogin <user>

From /etc/security/user

* rlogin        Defines whether the user account can be accessed by remote
*               logins.  Commands rlogin and telnet support this attribute.
*               Possible values: true or false.

From man rsh: "If you need to execute an interactive command on a remote host, use either the rlogin command or the rsh command without specifying the Command parameter. If you do not specify the Command parameter, the rsh command executes the rlogin command instead."

Note on Secure shell: The attributes (like rlogin) only affect the ssh and scp commands if the "UseLogin" attribute is set to "yes" in the ssh daemon configuration file on the server.

Usefull references:

  • User account control
  • man rsh
  • man rshd
  • /etc/security/user
  • /etc/hosts.equiv
  • man rhosts (.rhosts file)


The rlogin attribute does not affect rsh (or remsh) *with* command parameter specified. It does affect rsh *withouth* command parameter becourse then the rlogin client is actually triggered. At this time the rlogin attribute only affect rlogin (same as rsh withouth command), telnet and Secure shell if the UseLogin attribute is set. Knowing this, the part inbetween backets in "smitty user" is, at least, misleading!

rsh and the rcmds option

To controll rsh *with* command parameter (and also rexec) you should use the rcmds=deny option in /etc/security/user.

rcmds  Specifies whether the user account can be accessed with the rsh  
       or exec commands. A value of allow indicates that the account may
       be accessed by rsh and rexec. A value of deny indicates no       
       account access by rsh and rexec commands. A value of             
       hostlogincontrol indicates that the account access is controlled 
       by hostallowedlogin and hostsdeniedlogin attributes.             

rcmds=deny  rexec, rsh, rcp, ssh, scp                                   

rcmds=hostlogincontrol and 
hostsdeniedlogin=<target_hosts>  rexec, rsh, 
                                 rcp, ssh,   
                                 scp, rlogin,
                                 telnet, ftp,

Note: rcmds disallows execution of remote commands. Remote logins (rlogin) are still permitted. So to completely block rsh you need to set both the rlogin attrinbute and the rcmds option.

JFS2 freeze/thaw

See APAR: IY66043

To freeze a filesystem:
chfs -a freeze=<timeout in seconds> /fsname

To thaw a filesystem:
chfs -a freeze=off /fsname

Online verification to check the LVCB and / or VGDA

The mirscan command (introduced at 5.3 TL 3 I think). Note that this will generate significant amounts of I/O and takes a verry long time to run!

mirscan -v vgname | -l lvname | -p pvname | -r reverse_pvname [ -a ] [ -o ] 
        [ -q nblks ] [ -c lvcopy ] [ -s strictness ] [ -u upperbound ]

-a Specifies that corrective action should be taken.

print to ASCII file and backend scripts

Example to setup a ASCII printer for printing to a file (all prints will be appended to the files).

$ touch /dev/printfile
$ smitty - ... - add print queue
Add a Print Queue : file File (in /dev directory)
Printer Type : Other ; generic      Generic Printer
New print queues to add:  ASCII [printfile]
(INITIALIZE printer? no)
(Send FORM FEED after each file? yes)

Result in /etc/qconfig
        device = printfile01
        file = /dev/printfile01
        header = never
        trailer = never
        access = both
        backend = /usr/lib/lpd/piobe

Example of execution queue (invoke with: qprt -Psh myscript)

       device = bshdev
       backend = /usr/bin/ksh

Example for backend scripting

       device = scrdev
       backend = /tmp/

echo "newprint: $(date)" > /tmp/test1.out
echo $* >> /tmp/test1.out
echo $1 >> /tmp/test1.out
echo $# >> /tmp/test1.out
cat $1 >> /tmp/test1.out

Usefull queue options:

 backend = /usr/lib/lpd/rembak -T120
 recovery_type = sendmail

Tip: use remote printing to submit data.

RMC subsystem

keywords: ctrmc, rmcctrl

The prefered method to restart the RMC susbsystem is not to use stopsrc or refresh but using rmcctrl.

/usr/sbin/rsct/bin/rmcctrl -z 
/usr/sbin/rsct/bin/rmcctrl -A 
/usr/sbin/rsct/bin/rmcctrl -p 

Usefull print config commands

$ enq -isA | grep DOWN | while read AA ZZ
  print -n "$AA|"
done; echo ""

$ cat /etc/qconfig \
| grep -v "^*" \
| perl -p -e 's/^([^\t|\s])/\n\1/' \
| grep -p -E "xxx|yyy|zzz" \
| grep -E ":|host|rq"

$ enq -isA | grep DOWN | while read AA ZZ
  ls -ltr /var/spool/lpd/qdir/*:${AA}* | tail -1

$ enq -A  > /tmp/printerr.out 2>&1
$ sed '/^$/d' /tmp/printerr.out | grep -E "WARNING|ERROR"

cleanup wtmp, sulog

# convert binary to ASCII
/usr/sbin/acct/fwtmp < /var/adm/wtmp > /tmp/wtmp

# cut-off
tail -1000 /tmp/wtmp > /tmp/wtmp2

# convert ASCII to binary
/usr/sbin/acct/fwtmp -ic < /tmp/wtmp2 > /var/adm/wtmp

# cut-off
tail -1000 /var/adm/sulog > /tmp/sulog
cat /tmp/sulog > /var/adm/sulog

rm /tmp/wtmp2 /tmp/wtmp /tmp/sulog

can i find the creation time of a file?

No! All UNIX variants show you the access time of the file, modification time of the file and change time of the inode. Every time you change permissions or update the file inode this time is changed. for database files you will notice that all dates are the same :(

istat, ls -li + fsdb or the perl stat function might be useful to you on AIX.

User related commands I cannot remember

pwdadm -q $USERNAME # Queries the status of the password
pwdadm -c $USERNAME # Clears all password flags
pwdadm -f ADMCHG $USERNAME # Resets the ADMCHG attribute

lsuser -a time_last_login $USERNAME | cut -d = -f 2 | xargs perl -e 'print "time_last_login: ".localtime($ARGV[0])."\n"'

lsuser -a account_locked $USERNAME
chuser account_locked='true' $USERNAME
chuser account_locked='false' $USERNAME

lsuser -a unsuccessful_login_count $USERNAME
chsec -f /etc/security/lastlog -a "unsuccessful_login_count=0" -s $USERNAME

lsuser -a registry $USERNAME

fast query


lsuser -a time_last_login $USERNAME | cut -d = -f 2 | xargs perl -e 'print "time_last_login: ".localtime($ARGV[0])."\n"' ; lsuser -a unsuccessful_login_count $USERNAME ; lsuser -a account_locked $USERNAME ; lsuser -a registry $USERNAME ; pwdadm -q $USERNAME

finger ; who -u | grep $USERNAME

admin · attr · attach · edit · history · print
Page last modified on November 08, 2008, at 04:13 PM