aix_kernel_tunables

Manage AIX kernel level settings

Project URL RSS Feed

Module Stats

8,586 downloads

8,586 latest version

1.9 quality score

Version information

released Nov 5th 2014

This version is compatible with:

Puppet Enterprise 3.3.x
Puppet 3.0
AIX

Start using this module

Installation method

Add this module to your Puppetfile:

mod 'BashTheStampede-aix_kernel_tunables', '0.1.0'

Learn more about managing modules with a Puppetfile

Add this module to your Bolt project:

bolt module add BashTheStampede-aix_kernel_tunables

Learn more about using this module with an existing project

Manually install this module globally with Puppet module tool:

puppet module install BashTheStampede-aix_kernel_tunables --version 0.1.0

Tags: security, aix, usersec

Documentation

BashTheStampede/aix_kernel_tunables — version 0.1.0 Nov 5th 2014

Puppet module to manage AIX kernel tunable settings

This module is a custom type/provider taht enables the ability to manage AIX kernel tunables through puppet.

Requirements

Module has been tested on:

PE Puppet 3.3
OS:
- AIX 5.3
- AIX 6.1
- AIX 7.1

Note: This module does currently does not manage restricted tunable parameters.

Example settings

class { 'kernel_settings'
  asoo { 'default_settings':
    aso_active => '0',  
  }

  ioo { 'ioo_settings':
    aio_active  => '1',
    aio_maxreqs => '3'
  }

  nfso ( 'nfso_settings':
    portcheck => '1'
  }

  no { 'no_settings':
    sb_max => '32',
    tcp_recvspace '32890',
  }
  
  schedo { 'schedo_settings':
    vpm_fold_policy => '1',
  }
  
  vmo { 'vmo_tunables':
    maxfree => '32',
    minfree => '16',
  }
}

Types in this module release

vmo

Manages the AIX vmo kernel tunables See the man page for the full details for this command.

    Example:
    vmo { 'vmo_tunables':
        your_tunable_parameter => your_tunable_value,
        your_next_tunable_parameter => your_tunable_value,
    }

Parameters
name
provider

Properties
esid_allocator	Turns on/off Large Segment Aliasing (LSA) effective address allocation policies.
lgpg_regions	Specifies the number of large pages to reserve for implementing with the shmget() system call with the SHM_LGPAGE flag.
lgpg_size	Specifies the size in bytes of the hardware-supported large pages used for the implementation for the shmget() system call with the SHM_LGPAGE flag.
lru_poll_interval	Determines the interval, in milliseconds, at which LRU page replacement daemons poll for off-level interrupts.
maxfree	Specifies the number of frames on the free list at which page-stealing is to stop.
maxperm_pct	Specifies the point above which the page-stealing algorithm steals only file pages.
maxpin_pct	Specifies the maximum percentage of real memory that can be pinned.
memory_affinity	Enables the VMM support for local memory allocation.
minfree	Specifies the number of frames on the free list at which the VMM starts to steal pages to replenish the free list.
minperm_pct	Specifies the point below which the page-stealer will steal file or computational pages regardless of repaging rates.
page_steal_method	Selects Virtual Memory Page Replacement policy.
strict_maxclient	If set to 1, the maxclient value will be a hard limit on how much of RAM can be used as a client file cache.
strict_maxperm	If set to 1, the maxperm value will be a hard limit on how much of RAM can be used as a persistent file cache.
v_pinshm	If set to 1, will allow pinning of shared memory segments.
vmm_klock_mode	Select the kernel memory locking mode.

Providers
aix	manages kernel tunables for AIX vmo

asoo

Manages the AIX asoo kernel tunables See the man page for the full details for this command.

    Example:
    asoo { 'asoo_tunables':
        your_tunable_parameter => your_tunable_value,
        your_next_tunable_parameter => your_tunable_value,
    }

Parameters
name
provider

Properties
aso_active	Disables ASO.
debug_level	Specifies the ASO debug logging level.

Providers
aix	manages kernel tunables for AIX asoo

ioo

Manages the AIX ioo kernel tunables See the man page for the full details for this command.

    Example:
    ioo { 'ioo_tunables':
        your_tunable_parameter => your_tunable_value,
        your_next_tunable_parameter => your_tunable_value,
    }

Parameters
name
provider

Properties
aio_active	Indicates whether the AIO kernel extension has been used and pinned
aio_maxreqs	Specifies the maximum number of asynchronous I/O requests that can be outstanding at one time
aio_maxservers	Specifies the maximum number of AIO servers (kernel processes dedicated to asynchronous I/O processing) allowed to service slow path I/O requests.
aio_minservers	Specifies the minimum number of AIO servers (kernel processes dedicated to asynchronous I/O processing) that remain active to process slow path I/O requests.
aio_server_inactivity	Specifies how long an AIO server will sleep without servicing an I/O request.
j2_atimeUpdateSymlink	If j2_atimeUpdateSymlink is set to 1, then the access time of JFS2 symbolic links is updated on readlink.
j2_dynamicBufferPreallocation	Specifies the number of 16K slabs to preallocate when the filesystem is running low of bufstructs.
j2_inodeCacheSize	Controls the amount of memory Enhanced JFS will use for the inode cache.
j2_maxPageReadAhead	Specifies the maximum number of pages to be read ahead when processing a sequentially accessed file on Enhanced JFS.
j2_maxRandomWrite	Specifies a threshold for random writes to accumulate in RAM before subsequent pages are flushed to disk by the Enhanced JFS's write-behind algorithm.
j2_metadataCacheSize	Controls the amount of memory Enhanced JFS will use for the metadata cache.
j2_minPageReadAhead	Specifies the minimum number of pages to be read ahead when processing a sequentially accessed file on Enhanced JFS.
j2_nPagesPerWriteBehindCluster	Specifies the number of pages per cluster processed by Enhanced JFS's write behind algorithm.
j2_nRandomCluster	Specifies the distance apart (in clusters) that writes have to exceed in order for them to be considered as random by the Enhanced JFS's random write behind algorithm.
j2_recoveryMode	Sets the behavior for recovery from JFS2 write errors.
j2_syncPageCount	Sets the maximum number of modified pages of a file that will be written to disk by the sync system call in a single operation.
j2_syncPageLimit	Sets the maximum number of times that the sync system call will use j2_syncPageCount to limit pages written before increasing that count to allow progress on the sync operation.
lvm_bufcnt	Specifies the number of LVM buffers for raw physical I/Os.
maxpgahead	Specifies the maximum number of pages to be read ahead when processing a sequentially accessed file.
maxrandwrt	Specifies a threshold (in 4 KB pages) for random writes to accumulate in RAM before subsequent pages are flushed to disk by the write-behind algorithm.
numclust	Specifies the number of 16 k clusters processed by the sequential write-behind algorithm of the VMM.
numfsbufs	Specifies the number of file system bufstructs.
pd_npages	Specifies the number of pages that should be deleted in one chunk from RAM when a file is deleted.
posix_aio_active	Indicates whether the AIO kernel extension has been used and pinned.
posix_aio_maxreqs	Specifies the maximum number of asynchronous I/O requests that can be outstanding at one time.
posix_aio_maxservers	Specifies the maximum number of AIO servers (kernel processes dedicated to asynchronous I/O processing) allowed to service slow path I/O requests.
posix_aio_minservers	Specifies the minimum number of AIO servers (kernel processes dedicated to asynchronous I/O processing) that remain active to process slow path I/O requests.
posix_aio_server_inactivity	Specifies how long an AIO server will sleep without servicing an I/O request.
spec_accessupdate	Indicates for devices how timestamp changes are reflected.

Providers
aix	manages kernel tunables for AIX ioo

schedo

Manages the AIX schedo kernel tunables See the man page for the full details for this command.

    Example:
    schedo { 'schedo_tunables':
        your_tunable_parameter => your_tunable_value,
        your_next_tunable_parameter => your_tunable_value,
    }

Parameters
name
provider

Properties
vpm_fold_policy	Controls the application of the virtual processor management feature of processor folding in a partition.
vpm_xvcpus	Setting this tunable to a value greater than -1 will enable the scheduler to enable and disable virtual processors based on the partition's CPU utilization.

Providers
aix	manages kernel tunables for AIX schedo

nfso

Manages the AIX nfso kernel tunables See the man page for the full details for this command.

    Example:
    nfso { 'nfso_tunables':
        your_tunable_parameter => your_tunable_value,
        your_next_tunable_parameter => your_tunable_value,
    }

Parameters
name
provider

Properties
nfs_use_reserved_ports	Specifies using nonreserved IP port number.
portcheck	Checks whether an NFS request originated from a privileged port.

Providers
aix	manages kernel tunables for AIX nfso

no

Manages the AIX no kernel tunables See the man page for the full details for this command.

    Example:
    no { 'no_tunables':
        your_tunable_parameter => your_tunable_value,
        your_next_tunable_parameter => your_tunable_value,
    }

Parameters
name
provider

Properties
bcastping	Allows response to ICMP echo packets to the broadcast address.
clean_partial_conns	Specifies whether or not we are avoiding SYN attacks. If non-zero, clean_partial_conns specifies how many partial connections to randomly remove to make room for new non-attack connections.
directed_broadcast	Specifies whether or not to allow a directed broadcast to a gateway.
icmpaddressmask	Specifies whether the system responds to an ICMP address mask request.
ip6srcrouteforward	Specifies whether the system forwards source-routed IPv6 packets.
ipforwarding	Specifies whether the kernel should forward packets.
ipignoreredirects	Specifies whether or not to process redirects that are received.
ipsendredirects	Specifies whether the kernel should send redirect signals.
ipsrcrouteforward	Specifies whether the system forwards source routed packets.
ipsrcrouterecv	Specifies whether the system accepts source routed packets.
ipsrcroutesend	Specifies whether applications can send source routed packets.
nonlocsrcroute	Tells the Internet Protocol that strictly source-routed packets may be addressed to hosts outside the local network.
rfc1323	Enables TCP enhancements as specified by RFC 1323, TCP Extensions for High Performance.
rtentry_lock_complex	Specifies the type of Lock to be used for RTENTRY Lock macros.
sb_max	Specifies the maximum buffer size allowed for a TCP and UDP socket. Limits setsockopt, udp_sendspace, udp_recvspace, tcp_sendspace, and tcp_recvspace.
sockthresh	Specifies the maximum amount of network memory that can be allocated for sockets. Used to prevent new sockets or TCP connections from exhausting all MBUF memory and reserve the remaining memory for the existing sockets or TCP connections.
tcp_mssdflt	Default maximum segment size used in communicating with remote networks.
tcp_pmtu_discover	Enables or disables path MTU discovery for TCP applications.
tcp_recvspace	Specifies the system default socket buffer size for receiving data. This affects the window size used by TCP.
tcp_sendspace	Specifies the system default socket buffer size for sending data.
tcp_tcpsecure	Specifies whether or not connection reset attacks and data corruption attacks on TCP are avoided.
udp_pmtu_discover	Enables or disables path MTU discovery for UDP applications.
udp_recvspace	Specifies the system default socket buffer size for receiving UDP data.
udp_sendspace	Specifies the system default socket buffer size (in bytes) for sending UDP data.
use_isno	Enables the use of Interface Specific Network Options.

Providers
aix	manages kernel tunables for AIX no

The MIT License (MIT)

Copyright (c) 2014 Electric Reliability Council of Texas

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
THE SOFTWARE.

Modules

Discover

Contribute

Resources

About Forge

Getting Started