Use nettladm

[Jose_129]

When use nettladm presents some lines to me that detail to subsystem name, that they indicate to me?

100 Mb/s LAN/9000 btlan
100BT/Gigabit Ethernet IETHER
ARPA/9000 NETWORKING NS_LS_BUFS
ARPA/9000 NETWORKING NS_LS_CASE21
ARPA/9000 NETWORKING NS_LS_ICMP
ARPA/9000 NETWORKING NS_LS_IGMP
ARPA/9000 NETWORKING NS_LS_IP
ARPA/9000 NETWORKING NS_LS_IPC
ARPA/9000 NETWORKING NS_LS_LOGGING
ARPA/9000 NETWORKING NS_LS_LOOPBACK
ARPA/9000 NETWORKING NS_LS_NETISR
ARPA/9000 NETWORKING NS_LS_NFS
and others..

[Francois LAURENT]

Hi jose,

This list the subsystems which are logged in /var/adm/nettl.LOG00

you can view only a subsystem in this log, by using a filter file and netfmt comand.

see KBRC00001272 for more informations.

hope this help

[Bill McNAMARA_1]

as mentioed these are filters that you can use when viewing nettl log files.
nettladm will allow you to view the logs too.

[Jose_129]

where can find paper?

[Sanjay_6]

Hi Jose,

Try this link,

http://www1.itrc.hp.com/service/cki/search.do?category=c0&mode=id&searchString=KBRC00001272&searchCrit=allwords&docType=Security&docType=Patch&docType=EngineerNotes&docType=BugReports&docType=Hardware&docType=ReferenceMaterials&docType=ThirdParty&search.x=10&search.y=15

Just search for the doc using doc id in the link,

http://www1.itrc.hp.com/service/cki/enterService.do

Hope this helps.

Regds

[Jose_129]

Ok, but that means each subsystem?

http://www1.itrc.hp.com/service/cki/search.do?category=c0&mode=id&searchString=KBRC00001272&searchCrit=allwords&docType=Security&docType=Patch&docType=EngineerNotes&docType=BugReports&docType=Hardware&docType=ReferenceMaterials&docType=ThirdParty&search.x=10&search.y=15


KBRC00001272:
Your search produced no results. It is either too specific or has spelling errors. Try a different search string or change your search criteria selection.

[Jose_129]

As I interpret log?

[Francois LAURENT · Accepted solution]

Hi Jose,

yes you have to interprete logs, with the filters's help as you can see in KBRC00001272
If you don't manage to view it, take a look at this join, sorry for the format ...

hope this help

[Jose_129]

attached error when unloading to paper

[Francois LAURENT]

in my last message, i give you a copy of the doc in a MSexel file ...

[Jose_129]

Like monitor a direction IP.

FILTER EXAMPLE #1: To view packets sent to and received from an IP address by the host running the nettl trace:

filter ip_saddr 192.6.2.1
filter ip_daddr 192.6.2.1

# filter ip_saddr 192.168.1.221
sh: filter: not found.

[Francois LAURENT]

Hi Jose,

"filter" is not a command, but you have to create a filter file, named /tmp/filterfile for exemple. This contains the 2 lines :
filter ip_saddr 192.6.2.1
filter ip_daddr 192.6.2.1

After you have to use netfmt command to filter your log :
for 10.20 and 11.00:
#netfmt -N -n -l -c /tmp/filterfile -f /tmp/raw0.TRC0 > /tmp/fmt- 10
for 11.11 or up :
# netfmt -N -n -l -c /tmp/filterfile -f /tmp/raw0.TRC000 > /tmp/fmt- 10

[Jose_129]

I have:

# netfmt -N -n -l -c /tmp/filterfile -f /tmp/raw0.TRC000 > /tmp/fmt-10

netfmt (169) Warning: The input file was created in a timezone that
is different from the present timezone. You may want to
adjust the environment variable TZ while formatting this file.
TZ found in trace/log file header: MST7MDT
TZ of this process: SAT5

# filter ip_saddr 192.168.1.235
sh: filter: not found.
# filter ip_daddr 192.168.1.235
sh: filter: not found.
# filter ip_saddr 192.168.1.221
sh: filter: not found.

[Jose_129]

Any news...

[Francois LAURENT]

don't worry about TZ warning, your outpout file is well writed. Note that "filter" is not a command line ...

[Jose_129]

That I can do?