sentry-arp-cache

Retrieves ARP cache information of a sentry.

Syntax

sentry-arp-cache [timeout=INT]
Parameter
timeout=INT
RPC timeout in seconds (default: 30 seconds)

Description

This query command sends asynchronous RPC request messages to 100 sentries at the same time and waits for responses.The RPC request message queue operates on a first-in, first-out (FIFO) basis. For example, if the Logpresso server needs to send RPC messages to 150 sentries, the server sends an RPC message to 100 sentries first and waits until RPC responses. If the waiting time exceeds the time specified in the timeout (default: 30 seconds), it is considered that an error has occurred on the sentry side. If 32 out of 100 sentries respond or timeout is exceeded, the Logpresso server sends an RPC message to the additional 32 sentries.

The query command outputs the results of RPC response messages in the order they are received. Depending on the load or network conditions of the host where Sentry is installed, the order of the responses may vary with each execution. Use the output data but do not rely on the order of the records.

Tip
Logpresso environment variable `logpresso.core.sentry_rpc_parallel` determines the length of the asynchronous RPC request message queue. The default value is `100` and you can adjust the length by modifying the value of this environment variable.
Input Field

This query command requires that the input record contains a guid field value.

FieldTypeDescription
guidStringUnique sentry identifier (Not relevant to GUID in JAVA)
Output Fields

This query command returns the fields below in addition to the fields from input record.

FieldTypeDescription
typeStringARP cache entry type (static, dynamic, invalid)
ipIP AddressIP address
macStringMAC address

If any error occurs, this query command returns an _error field in addition to the fields from input record. Possible errors are as follows:

Error MessageDescription
guid is nullguid field value from input record is null.
guid should be stringguid field value from input record is not a string.
guid should be non empty stringguid field value from input record is empty.
timeoutRPC request timeout exceeded
disconnectedDisconnected while processing RPC request
not connectedSentry is not connected.

Depending on the system where the sentry is installed, an RPC exception message other than the above can be issued.

Usage

  1. Get ARP cache information from all sentries.
sentry | fields guid | sentry-arp-cache