sentry-arp-cache

Retrieves the ARP cache table from a remote sentry.

Command properties

Property	Description
Command type	Transforming
Required permission	Administrator
License usage	N/A
Parallel execution	Supported
Distributed execution	Not supported

Syntax

sentry-arp-cache [timeout=INT]

Options

timeout=INT: RPC timeout in seconds. Accepts a value between 1 and 600. (Default: 30)

Input fields

Field	Type	Required	Description
guid	string	Required	Sentry unique identifier.

Output fields

Field	Type	Description
guid	string	Sentry unique identifier.
type	string	ARP cache entry type. For the values by operating system, see the table below.
ip	ipaddr	IP address.
mac	string	MAC address.
adapter	string	Network adapter. For the values by operating system, see the table below.
_error	string	Error message if an error occurred.

The values of the type and adapter fields depend on the operating system where the sentry is installed:

Operating system	type	adapter
Linux	`dynamic` if the Flags column value in `/proc/net/arp` is `0x2`, `static` if it is `0x4`, `invalid` if it is `0x10`, and an empty string for any other value (including values with multiple flags set).	Network interface name (the Device column value in `/proc/net/arp`).
Windows	One of `static`, `dynamic`, `invalid`, or `other`.	Network adapter description. null if no adapter information is found.
AIX	The string in square brackets in the output of the `arp -na` command (for example, `ethernet`).	null
HP-UX	The string in square brackets in the output of the `arp -a` command.	The last word of the output line of the `arp -a` command.
Solaris	The Flags column value in the output of the `arp -a` command. `o` is replaced with `old`, `A` with `authority`, `d` with `unverified`, and `y` with `delayed`; any other value is assigned as is. null if the Flags column has no value.	The Device column value in the output of the `arp -a` command.

Windows sentries assign the MAC address to the mac field as two-digit lowercase hexadecimal values separated by colons (:), and assign null if the address is not 6 bytes long. Other sentries assign the notation in /proc/net/arp or in the output of the arp command as is.

Solaris sentries send the IP Address column value in the output of the arp -a command as is, so the ip field is null if this value is a host name.

Error codes

Parsing errors

Error code	Message	Description
23100	no sentry rpc permission	A user without administrator privileges ran the command.
23101	invalid sentry rpc timeout. use timeout between 1 and 600.	The `timeout` option value is not a number or is outside the range 1–600.

Runtime errors

Depending on the guid field value, the following error messages may be assigned to the _error field:

Error message	Description
guid is null	The `guid` field value in the input record is null.
guid should be string	The `guid` field value in the input record is not a string.
guid should be non empty string	The `guid` field value in the input record is an empty string.
not connected	The sentry is not connected.
timeout	The RPC request timed out.
disconnected	The sentry connection was already lost when the RPC request was sent.

Other RPC exception messages may be assigned to the _error field depending on the state of the system where the sentry is installed.

Description

The sentry-arp-cache command sends asynchronous RPC messages requesting ARP cache information to remote sentries identified by the guid field of each input record. When a response is received from a sentry, the ARP cache information is added to the input record and output.

The maximum length of the asynchronous RPC request queue is 100 by default and can be adjusted using the logpresso.core.sentry_rpc_parallel environment variable. When the queue is full and some sentries respond or time out, new RPC messages are sent to fill the freed slots.

Results are output in the order RPC responses are received, so the output record order may differ from the input record order.

To retrieve results from all Data Nodes at once in a cluster environment, use the sonar-sentry-arp-cache command.

Examples

Retrieve the ARP cache from all sentries
```
system-sentries | fields guid | sentry-arp-cache
```
Retrieves the ARP cache table from all connected sentries.
Retrieve with a 60-second timeout
```
system-sentries | fields guid | sentry-arp-cache timeout=60
```
Retrieves the ARP cache with the RPC timeout set to 60 seconds.

Change history

The sentry-arp-cache command has been available since before Sonar 4.0.