Solaris, AIX, and macOS Datasets

Solaris, AIX, and macOS datasets define what the Director reads from an Oracle Solaris, AIX, or macOS device, over SSH and with nothing installed on the host (dataset types solaris, aix, and macos). Each operating system has the same four datasets, and a device takes only its own operating system's. To create and assign datasets through the web interface, see Management. For the dataset and profile model, see Overview.

Collector Types

Dataset (console title)	Definition	Definition id	Default interval
Solaris / AIX / macOS Inventory	`<os>_inventory_collector`	350 / 360 / 400	3600 s
Solaris / AIX / macOS Metrics	`<os>_metrics_collector`	351 / 361 / 401	60 s
Solaris / AIX / macOS File Logs	`<os>_file_log_collector`	1000 (custom log)	10 s
Solaris / AIX / macOS Scripts	`<os>_script_collector`	851 (custom script)	60 s
Certificates	`<os>_certificate_collector`	4111 / 4211 / 4311	3600 s
macOS WireGuard, interfaces	`macos_wireguard_interface_collector`	4356 (macOS only)	60 s
macOS WireGuard, peers	`macos_wireguard_peer_collector`	4357 (macOS only)	60 s

<os> is solaris, aix, or macos. File logs and scripts carry the ids of the Linux collectors of the same kind, so a pipeline or a target keyed on those treats them alike. The certificate and WireGuard datasets are datasets of their own, not parts of the inventory or the metrics.

Every dataset is read when the device starts, then on its interval. Every dataset takes these properties:

Field	Required	Type	Default	Description
`interval`	N	int	per dataset	Seconds between readings. At least `10`.
`pipeline_name`	N	string	the device's	The preprocessing pipeline the dataset's records enter.

note

A device reads one inventory and one metrics dataset. A second one of either is left out with a warning in the Director's log. File log and script datasets add up.

Any change to the device or to its datasets restarts it: rates start over, and log files are read from their end again.

Inventory and Metrics

The inventory reads what the host has; the metrics read how it is doing. Both read parts, named in items:

Field	Required	Type	Default	Description
`items`	N	string[]	every part	The parts to read, as listed below.

note

Inventory and metrics datasets can be created through the dataset creation wizard (Solaris Inventory, AIX Metrics, and so on, under the Oracle Solaris, AIX, or macOS category) or configured via device YAML files under config/devices/.

Wizard fields

The Dataset configuration step asks for:

Field	Required	Behavior
Interval (Optional)	N	In seconds. Leave empty to use the dataset's default interval. At least `10`.
Parts to read	Y	At least one part must be ticked. All parts are ticked by default.
Pre-processing pipeline	N	The pipeline the dataset's records enter, as on every dataset.

The wizard writes interval only when one is entered, and items only when a part is left out. An untouched dataset therefore reads every part on the default interval.

Inventory parts

The console names the parts that differ by operating system after what they are on each one.

Part	Solaris	AIX	macOS
`host`	Host	Host	Host
`processors`	Processors	Processors	Processors
`memory`	Memory	Memory	Memory
`filesystems`	File systems	File systems	File systems
`disks`	Disks	Disks	Disks
`pools`	ZFS pools	Volume groups	APFS containers
`network`	Network interfaces	Network interfaces	Network interfaces
`packages`	Packages (IPS and SVR4)	Filesets (LPP)	Installer packages
`updates`	Pending package updates	—	—
`services`	SMF services	SRC subsystems	launchd services
`processes`	Processes	Processes	Processes

AIX and macOS have no updates part. On Solaris 10 the part is not read either, since it has no package repository to ask; the Director says so once, as information.

From a part's second reading on, every item carries event.action: added, changed, unchanged, or removed. An item gone since the last reading is written once more, as it was, marked removed. Values that move without the item changing, such as the host's uptime or a pool's free space, are left out of the comparison.

Metrics parts

Part	Console label	One document per
`cpu`	CPU usage	reading
`memory`	Memory usage	reading
`filesystem`	File system usage	file system
`diskio`	Disk I/O	disk
`network`	Network traffic	network interface
`processes`	Busiest processes	busy process

The busiest processes are the 25 that use the most CPU and the 25 that use the most memory. Percentages are fractions of one: 0.25 is a quarter.

CPU, disk I/O, and process CPU are what the host measured over the sampling second. The network counters are the host's since boot: a document gives what they gained since the last sample and the rate over it, so the first sample after a start writes none, and a counter that went backwards (a reboot, a driver reload) is left out of that sample.

Output

Inventory and metrics records are ECS documents with event.module set to the operating system and event.dataset set to <os>.<dataset>. event.kind is state for the inventory and metric for the metrics.

Dataset	Part	`event.dataset`
Inventory	`host`	`<os>.host`
Inventory	`processors`	`<os>.processor`
Inventory	`memory`	`<os>.memory`
Inventory	`filesystems`	`<os>.filesystem`
Inventory	`disks`	`<os>.disk`
Inventory	`pools`	`<os>.pool`
Inventory	`network`	`<os>.interface`
Inventory	`packages`	`<os>.package`
Inventory	`updates`	`<os>.update`
Inventory	`services`	`<os>.service`
Inventory	`processes`	`<os>.process`
Metrics	`cpu`	`<os>.cpu`
Metrics	`memory`	`<os>.memory_stats`
Metrics	`filesystem`	`<os>.filesystem_stats`
Metrics	`diskio`	`<os>.diskio`
Metrics	`network`	`<os>.interface_stats`
Metrics	`processes`	`<os>.process_stats`

Example

Reading a Solaris host's inventory without its processes, and its metrics every 30 seconds...

devices:
  - id: 471209401
    name: sol-db-01
    type: solaris
    status: true
    properties:
      address: "192.0.2.20"
      username: "vmetric"
      password: "$secret{unix/sol-db-01}"
    definitions:
      - name: solaris_inventory_collector
        status: true
        properties:
          items: [host, processors, memory, filesystems, disks, pools, network, packages, updates, services]
      - name: solaris_metrics_collector
        status: true
        properties:
          interval: 30
          pipeline_name: my-pipeline

Certificates

The solaris_certificate_collector, aix_certificate_collector, and macos_certificate_collector read the certificates the host holds, as an inventory, as the Linux Certificates dataset reads a Linux host's — see Linux Certificates. Solaris and AIX read certificate files; a Mac reads its keychains. All three read the keystores the dataset names.

Collector	`event.dataset`	Definition id	Default interval
`solaris_certificate_collector`	`solaris.certificate`	4111	3600 s
`aix_certificate_collector`	`aix.certificate`	4211	3600 s
`macos_certificate_collector`	`macos.certificate`	4311	3600 s

Properties

Besides interval and pipeline_name:

Field	Required	Type	Default	Description
`certificate_paths`	N	string[]	Solaris: `/etc/certs`, `/etc/openssl`, `/etc/ssl`. AIX: `/var/ssl`, `/etc/ssl`. macOS: none	Where it reads certificate files, as on Linux.
`certificate_keychains`	N	string[]	`/Library/Keychains/System.keychain`, `/System/Library/Keychains/SystemRootCertificates.keychain`	macOS only. The keychains it lists, each an absolute path.
`keystore_paths`	N	string[]	—	The PKCS #12 and JKS keystores to read, a list or one comma-separated text, named as `certificate_paths` names files: a directory is walked for its `.p12`, `.pfx`, `.jks`, `.keystore` and `.truststore` files; a file a path names is read whatever it is called (`$JAVA_HOME/lib/security/cacerts`). See Keystores.
`keystore_password`	N	string	—	The keystores' password, one for all: plain text, `${ENV_VAR}`, or `$secret{...}`. A reference keeps it out of the dataset's settings.

How the certificates are read

Solaris and AIX walk files, as the Linux agent walks its own: an agent on the host from its own filesystem, the Director over SFTP, on the device's own connection and login. A host whose SSH server offers no SFTP subsystem is not read, with a warning saying so. OpenSSH and SunSSH offer it unless it is turned off.
A Mac lists its keychains with security find-certificate -a -p, each certificate a record with the keychain it is in as macos.certificate.keychain. The trust settings a user or an administrator set on a certificate are not carried. Files and keystores are read on a Mac only where certificate_paths or keystore_paths name them.
Keystores are read on all three where keystore_paths names them, as on Linux.
Chains are verified only with an agent on the host, against the host's trust store: see Chain Verification. A host the Director reads over SSH writes no chain, since the Director's trust store is not the host's.
A change to a certificate dataset's paths, keychains, or keystores restarts the device's collector, so every dataset of the device starts afresh.

Output

Each reading writes ECS inventory documents with event.kind set to state and event.dataset set to <os>.certificate, one per certificate, with the Linux Certificates dataset's fields under <os>.certificate. A certificate of a file or a keystore is written with its file as ECS's file; a Mac's keychain certificate with keychain. From a dataset's second reading on, event.action marks each certificate added, changed, unchanged, or removed.

Example

Reading a Mac's System and System Roots keychains every hour...

definitions:
  - name: macos_certificate_collector
    status: true
    properties:
      interval: 3600
      certificate_keychains:
        - /Library/Keychains/System.keychain
        - /System/Library/Keychains/SystemRootCertificates.keychain

macOS WireGuard

The macos_wireguard_interface_collector and macos_wireguard_peer_collector read the WireGuard interfaces wireguard-go runs on a Mac and their peers, as metrics, with the Linux WireGuard datasets' fields and rates under macos.wireguard_interface and macos.wireguard_peer — see WireGuard. Solaris and AIX have no WireGuard datasets.

Collector	`event.dataset`	Definition id	Default interval
`macos_wireguard_interface_collector`	`macos.wireguard_interface`	4356	60 s
`macos_wireguard_peer_collector`	`macos.wireguard_peer`	4357	60 s

Besides interval and pipeline_name, both take a filter: filter.interface.include and filter.interface.exclude, on the interfaces' utun names. With none, every interface is read. The peers dataset reads the peers of the interfaces its own filter keeps.

A Mac has no WireGuard in its kernel. What is read is wireguard-go's socket under /var/run/wireguard, which Homebrew's wireguard-tools starts (wg-quick up).
The App Store WireGuard app cannot be read: it runs its tunnels in a network extension that opens no socket.
Only an agent on the Mac reads them: the sockets answer root, and wg show over SSH would print every interface's private key to the login. A Mac the Director reads over SSH says so once, writes nothing for these datasets, and is read for its other datasets.

Example

Reading the WireGuard interfaces and peers of a Mac with an agent every minute...

definitions:
  - name: macos_wireguard_interface_collector
    status: true
    properties:
      interval: 60
  - name: macos_wireguard_peer_collector
    status: true
    properties:
      interval: 60
      filter:
        interface:
          include: ["utun*"]

File Logs

The <os>_file_log_collector reads lines appended to files on the host, over SSH, from where the last reading stopped. Each input names one file or a glob, as an absolute path that may hold *, ?, and [...].

note

File log datasets can be created through the dataset creation wizard (Solaris File Logs, AIX File Logs, or macOS File Logs) or configured via device YAML files under config/devices/.

A file already there when the device starts is read from its end: what it held was written before the device ran. A file that appears later is read from its start.
A file that is rotated (a new file under the same name) or truncated is read from its start.
A line still being written, with no newline yet, waits for the next reading.
Where each file was left is not kept across a restart of the device.

What is read goes through the input's reader properties as a Linux file log's does: filter_mode and filter_rules, line_parser, date_format, encoding, and pipeline_name for the input's own pipeline. See File Log Collection. start_date does not apply. A file the login cannot read is warned about once.

macOS

macOS writes most of its own logging to the unified log, which is not a file and is not read. What remains in files is the install log (/var/log/install.log) and the applications' own logs. A log file in a folder macOS protects needs Remote Login's Allow full disk access for remote users — see macOS.

Example

Reading the system messages and an application's logs on a Solaris host, leaving out debug lines...

definitions:
  - name: solaris_file_log_collector
    status: true
    inputs:
      - name: messages
        properties:
          path: /var/adm/messages
      - name: application
        properties:
          path: /var/opt/app/logs/*.log
          filter_mode: exclude
          filter_rules:
            - type: string
              source: "DEBUG"

Scripts

The <os>_script_collector runs scripts on the host over SSH, with the Linux scripts' interpreters and settings, and writes each line of their output as a record. An input names its script one of three ways:

script: a Library script, by name. It must be a Bash script: the host runs no PowerShell.
source with interpreter: an inline script body.
path: a script already on the host, by its absolute path.

interpreter is sh, bash, exe (the file itself, by its #! line), or any other name with shell set to the command that runs it. args, environment, working_directory, timeout, emit_on_error, cron, max_retries, and skippable work as on Linux. max_bytes caps the output the Director keeps, 8 MiB unless set.

note

Script datasets can be created through the dataset creation wizard (Solaris Scripts, AIX Scripts, or macOS Scripts) or configured via device YAML files under config/devices/.

Example

Listing an AIX host's inoperative subsystems every 15 minutes...

definitions:
  - name: aix_script_collector
    status: true
    inputs:
      - name: inoperative subsystems
        properties:
          source: "lssrc -a | awk 'NR > 1 && $NF == \"inoperative\"'"
          interpreter: sh
          cron: "*/15 * * * *"

Collector Types​

Inventory and Metrics​

Wizard fields​

Inventory parts​

Metrics parts​

Output​

Example​

Certificates​

Properties​

How the certificates are read​

Output​

Example​

macOS WireGuard​

Example​

File Logs​

Example​

Scripts​

Example​

Collector Types

Inventory and Metrics

Wizard fields

Inventory parts

Metrics parts

Output

Example

Certificates

Properties

How the certificates are read

Output

Example

macOS WireGuard

Example

File Logs

Example

Scripts

Example