A brief introduction to SOCK Data provider

Using the SOCK data provider, we can write monitoring data from unsupported operating systems. We can also use this data provider to "consolidate" the number of agents running on a system. This article provides a brief-walkthru of the SOCK data provider and how to write data to the data provider.

How does it work?
The SOCK data provider, by default, listens on PORT 7500 for incoming data. The port can be changed by editing the KUMP_DP_PORT variable in KUMENV file. We need to write our data records to this port using a socket writer and prepare an MDL to parse the data.

How do I enable the SOCK data provider?
The SOCK data provider is enabled by default. The KUMP_STARTUP_DP variable starts the ASFS data provider. However, if you want to start just the SOCK data provider and not ASFS DP, you can edit the KUMENV file and restart the Universal Agent.

How do I write data to the port?
You can easily write a Perl based socket writer such as the one given below. The following program takes a CSV (Comma separated) file with two fields per record and writes those records to the SOCK Data provider.


#!/bin/perl

use strict;
use Socket;

my ($host, $port, $iaddr, $paddr, $proto, $line);
my ($file, @fields);

$file = "inputexample.txt";

$host = "VIKING";
$port = 7500;

$paddr = sockaddr_in($port, inet_aton($host));
$proto = getprotobyname('tcp');

# open socket
socket(SOCK, PF_INET, SOCK_STREAM, $proto) or die "Socket:$!";

connect(SOCK, $paddr) or die "Connect failed: $!";

open (FILE, "$file") or die "Error opening date file $file:$!";
print SOCK "//SockEvent";

while()
{
chomp;
@fields = split(',');

print SOCK "{ApplName=SockEvent}{AttrGroup=GBSEXAMPLE}$fields[0],$fields[1]";
}
close(FILE);

print SOCK "//END-DP-INPUT";
close(SOCK);

Preparing the MDL
The MDL for the above program contains just two fields one containing field name and the second field containing the value. The sample MDL is given below.
Please note that in the //SOURCE statement, the hostname (VIKING) should be the host from which the data is being written.

//APPL SockEvent
//NAME GBSEXAMPLE E 300
//SOURCE SOCK VIKING
//ATTRIBUTES DLM=','
FIELDNAME D 25
FIELDVALUE D 10

Comments
I hope this article gave you an overall idea on how to use the SOCK data provider. One great way to learn the Universal agent data providers is to enroll for the ITM 6.1 workshops conducted by GulfBreeze. That will give you a first hand practical experience and our certified ITM Gurus will be there to answer your questions related to ITM 6.1. Hope you find this useful.