| Check | Status | Sev | Observed | What it means & how to fix |
|---|---|---|---|---|
| AIX release support | PASS | low | 7300-03-03-2540 — no announced end of support | This AIX release is in active support and still receives security fixes. Fix: n/a |
| Technology Level currency | WARN | high | 7300-03 (latest: 7300-04) | A newer Technology Level (7300-04) is available — known fixed defects and CVEs this box does not have. Fix: schedule an update to the latest TL/SP in a maintenance window (smitty update_all from a downloaded lpp_source). Path: smitty update_all to 7300-04 from a downloaded lpp_source. Check IBM FLRT for firmware/VIOS prereqs first. On a VIOS this AIX level is secondary — patch the VIOS with 'updateios' (or viosupgrade), not update_all; the VIOS level (vios_level, above) is the primary currency signal. |
| System firmware level | PASS | low | ML1060_079 | Firmware carries its own security and stability fixes, separate from AIX. Fix: compare this level against IBM FLRT for your machine type at your next maintenance window. |
| Hardware generation | PASS | low | 9105-22A (POWER10) | This hardware generation is in active support. Fix: n/a |
| VIOS level | FAIL | high | VIOS 3.1.4.10 — support ended 2026-04-30 | This VIOS line no longer receives fixes — and every client LPAR depends on this box. On a dual-VIOS pair, upgrade the standby VIOS first, fail client traffic over, then do the other. Fix: plan the VIOS upgrade to a supported stream (viosupgrade, or 'updateios' within a stream); do the second VIOS of the pair first if dual-VIOS. |
| Check | Status | Sev | Observed | What it means & how to fix |
|---|---|---|---|---|
| Installed build age | PASS | low | built week 2540 (~9 months ago) | The installed build is reasonably current. Fix: n/a |
| Fileset consistency | PASS | low | 10 filesets, 0 broken | All installed filesets are in a consistent state. Fix: n/a |
| Interim fixes (ifixes) | PASS | low | none installed | No interim fixes — updates will not be blocked by leftover efixes. Fix: n/a |
| Tracked security APARs | PASS | high | 1 of 1 tracked APARs present (data vintage 2026-07-01) | All tracked security APARs for this level are installed — by Service Pack or by an installed interim fix. Fix: n/a |
| OpenSSH / OpenSSL levels | PASS | low | openssh 9.8.102.2446, openssl 3.0.13.102 | The OpenSSL 3.x line is current for AIX; keep both current via security bulletins. Fix: n/a |
| IBM SDK Java lifecycle | PASS | low | Java 8 installed (Java8_64.jre 8.0.0.826, Java8_64.sdk 8.0.0.826) | Java 8 is the last IBM SDK on AIX — track its service window (standard support ended 2025-04-30; extended runs to 2030-12-31 with an AIX SWMA contract). (On a VIOS the bundled Java is maintained by the VIOS image via updateios, not patched directly — treat this as informational.) Fix: n/a |
| FLRT APAR exposure scan | PASS | low | no FLRT data supplied | No FLRT data supplied — download apar.csv from IBM FLRT and re-run with --apar-csv for the full exposure scan. The embedded security-APAR seed still runs above. Fix: download apar.csv from IBM FLRTVC and re-run: aixray-aix.sh --apar-csv apar.csv. |
| Reference data freshness | PASS | low | reference data 3 day(s) old | reference data 3 day(s) old — EOS dates, APARs and firmware levels reflect IBM data as of 2026-07-01. Fix: n/a |
| Check | Status | Sev | Observed | What it means & how to fix |
|---|---|---|---|---|
| Filesystem / | PASS | low | 23% used | Healthy free space. Fix: n/a |
| Filesystem /var | PASS | low | 30% used | Healthy free space. Fix: n/a |
| Filesystem /tmp | PASS | low | 10% used | Healthy free space. Fix: n/a |
| Other filesystems | PASS | low | none above 90% | No other filesystem is critically full. Fix: n/a |
| Inode usage (JFS2) | PASS | low | no filesystem above 90% inodes | JFS2 inode usage has headroom on every filesystem. Fix: n/a |
| Paging space | PASS | low | 1 space(s), 2% used | Memory pressure is low. Fix: n/a |
| LV mirror sync | PASS | low | no stale partitions | All logical volume copies are in sync. Fix: n/a |
| Volume group disks | PASS | low | all PVs active | Every volume group disk is present and active. Fix: n/a |
| Volume group free space | PASS | low | worst: rootvg 44% free | Every online volume group has room to extend a filesystem. Fix: n/a |
| MPIO path health | PASS | low | 4 paths / 2 disks, all enabled | Full path redundancy. Fix: n/a |
| Fibre Channel adapter errors | PASS | low | fcs0: CRC 0, link-fail 0, loss-sync 0; fcs1: CRC 0, link-fail 0, loss-sync 0 | No CRC or excessive link errors on the FC adapters (cumulative since boot). Fix: n/a |
| Volume group geometry | PASS | low | rootvg 128MB PP, 271 PP/disk | Physical-partition geometry is sane on every online VG — the PP size fits the VG size, so the allocation map is neither bloated (tiny PP) nor wasteful (huge PP). Fix: n/a |
| LV mirror placement | PASS | low | 11 mirrored LV(s), copies on separate disks | Every mirrored logical volume keeps its copies on separate physical volumes — the mirrors are real protection that survives a single-disk failure. Fix: n/a |
| Filesystem vs LV sizing | PASS | low | no filesystem lags its LV by 512MB+ | Every JFS2 filesystem is grown into the logical volume it sits on — no allocated-but-unusable slack between the LV and the filesystem. Fix: n/a |
| Legacy JFS filesystems | PASS | low | all filesystems are JFS2 | No legacy JFS filesystems — everything is JFS2, the current AIX filesystem. Fix: n/a |
| Mount options | PASS | low | /tmp separate; 8 jfs2 mount(s), all logged; 8 using default atime | Mount hygiene is sound: /tmp is its own filesystem and every JFS2 mount has a log. Performance options (noatime for read-heavy mounts, cio/dio for databases, rbrw) are workload-specific and left to the app owner — atime-on is the AIX default and fine unless a mount is known read-heavy. Fix: n/a |
| Paging space layout | PASS | low | 1 paging space(s), no single-disk contention Total paging 2048MB vs 2048MB RAM. | Paging-space placement is fine — no two paging spaces share a disk, and there is no cross-VG contention to relieve. (Utilisation is checked separately under Paging space.) Fix: n/a |
| Virtual FC (NPIV) mappings | PASS | low | 2 vfchost mapping(s), all LOGGED_IN | Every virtual-FC host adapter on this VIOS is logged in to the fabric — the client LPARs' NPIV paths through this VIOS are live. Fix: n/a |
| Virtual SCSI mappings | PASS | low | 1 vhost mapping(s), all backed | Every virtual-SCSI host adapter on this VIOS has a live backing device — the client LPARs' vSCSI disks served by this VIOS are mapped. Fix: n/a |
| Check | Status | Sev | Observed | What it means & how to fix |
|---|---|---|---|---|
| LPAR CPU entitlement | PASS | low | shared Uncapped, ent 1.00, physc 0.55 (55% entc), 2 VP SMT-4, idle 48% | Shared-pool CPU entitlement looks reasonable for this sample: consuming 55% of the 1.00-core guarantee, uncapped so it can burst. A small entitlement plus uncapped is efficient design. Snapshot, not a trend. Fix: n/a |
| Memory composition | PASS | low | computational 45%, file/numperm 35%, 4600MB avail (56%) | Memory has headroom: 45% computational, 4600MB available; no composition red flags in this snapshot. Fix: n/a |
| VMM cache tuning | PASS | low | minperm 3% / maxperm 90% / maxclient 90% (AIX defaults); numperm 35% | VMM cache tuning is at AIX defaults and the file cache is not pinned at its ceiling. Fix: n/a |
| JFS2 filesystem-buffer blocking | PASS | low | 0 filesystem I/Os blocked with no fsbuf | No JFS2 filesystem-buffer (fsbuf) starvation since boot — the buffer pool has kept up with I/O demand. Fix: n/a |
| LVM/paging buffer blocking | PASS | low | 0 pbuf and 0 psbuf blocks | No LVM pbuf or paging psbuf starvation since boot — buffer pools have kept up with disk and paging I/O. Fix: n/a |
| I/O pacing (maxpout/minpout) | PASS | low | maxpout=8193, minpout=4096 (paced) | System-wide I/O pacing is configured, so a runaway writer cannot monopolize a disk and starve interactive I/O. Fix: n/a |
| CPU headroom (snapshot) | PASS | low | idle 60%, physc 0.52, run queue r=1 vs 8 logical CPUs | CPU has headroom in this sample: idle 60% with a short run queue for 8 logical CPUs (point-in-time snapshot, not a trend). Fix: n/a |
| Paging activity (snapshot) | PASS | low | pi=0, po=0 in this sample | No active paging in this sample — memory demand is being met from RAM (this is the activity read; paging-space capacity is checked separately under storage). Fix: n/a |
| Adapter health | PASS | low | en0 1000 Mbps Full Duplex 0err; en1 1000 Mbps Full Duplex 0err | All ethernet interfaces are up with zero transmit/receive/CRC/buffer errors (counters cumulative since boot). Fix: n/a |
| Process limits (maxuproc) | PASS | low | busiest user 'root' 80 procs vs maxuproc 512 (15%) | Per-user process headroom is fine — the busiest user is well under the maxuproc fork ceiling. Fix: n/a |
| Check | Status | Sev | Observed | What it means & how to fix |
|---|---|---|---|---|
| Error log (7 days) | PASS | low | 0 error entries | A quiet error log — most outages announce themselves here first. Fix: n/a |
| Permanent hardware errors (30 days) | PASS | high | none | No permanent hardware errors logged. Fix: n/a |
| System dump device | PASS | low | primary: /dev/lg_dumplv | A panic here can be diagnosed. Fix: n/a |
| Recent crash evidence | PASS | low | none in 30 days | No recent crash dumps found. Fix: n/a |
| Error-logging daemon | PASS | low | errdemon running; errlog 1048576 bytes, duplicate-removal true | The error-logging daemon is up and the errlog is at or above the 1 MB default, so errors are captured with a reasonable history window. (The errlog is a fixed-size circular file — once full it overwrites the oldest entries, it never stops logging.) Fix: n/a |
| Decoded error labels | PASS | low | no non-informational errors in 7 days | Nothing but informational entries in the error log — no labels to decode. Fix: n/a |
| Pre-failure signatures | PASS | high | none in 7 days | None of the classic pre-failure patterns a veteran hunts for — disk/adapter errors, SAN/SCSI path faults, EPOW power or thermal events, memory ECC errors, LVM disk loss, or dump-device faults — appear in the error log for the last 7 days. Fix: n/a |
| Error notification methods | PASS | low | 2 custom alert method(s): /usr/local/bin/page_oncall PERM hardware; /usr/local/bin/page_oncall disk | Custom errnotify ODM methods run a site script when a matching error is logged, so critical errors reach a human (page/mail), not just the log. Fix: n/a |
| System dump history | PASS | low | no system dump ever recorded | The dump device has never captured a dump — expected on a box that has not panicked. It does mean the dump path is configured but unproven; only a real dump proves it works. (Whether a device is configured at all is checked separately under 'System dump device'.) Fix: n/a |
| Check | Status | Sev | Observed | What it means & how to fix |
|---|---|---|---|---|
| OS backup (mksysb) evidence | PASS | high | /image.data updated within 30 days | Local evidence of a recent mksysb — your OS restore point is fresh. Fix: n/a |
| rootvg redundancy | PASS | low | 2 disks, fully mirrored | The OS survives a single disk loss. On a VIOS this is the most critical disk on the box — its loss takes down I/O for every client LPAR that depends on this VIOS. Fix: n/a |
| rootvg quorum | PASS | low | QUORUM disabled on a 2-disk mirror | Quorum is disabled on the rootvg mirror — a single surviving disk can still vary on and boot. Fix: n/a |
| Boot device list | PASS | low | 2 boot devices | The box can boot from either mirror copy. Fix: n/a |
| Dump device sizing | PASS | low | device 2048 MB covers estimated dump 500 MB | The primary dump device (lg_dumplv, 2048 MB) is comfortably larger than the estimated dump for this LPAR (500 MB), so a panic can capture a complete image. Re-check 'sysdumpdev -e' after any memory increase — the estimate tracks RAM. Fix: n/a |
| Dump copy directory | PASS | low | copy dir /var/adm/ras has 1433 MB free (>= estimate 500 MB) | The copy directory (/var/adm/ras) has room for a dump of the estimated size, so after a panic the image can be copied off the device and preserved for analysis. Fix: n/a |
| Boot image currency | PASS | low | booted Jun 15, after kernel bos.mp64 install 01/10/26 | The system last booted AFTER the running kernel (bos.mp64) was installed, so the running kernel matches what is on disk and no kernel-update reboot is outstanding. (AIXray is read-only: it cannot inspect the hd5 boot image directly, so this compares the kernel install date to the last boot as a proxy for boot-image currency.) Fix: n/a |
| SEA failover posture | PASS | low | ent4 state=PRIMARY ha=Auto | This VIOS's Shared Ethernet Adapter(s) report a defined HA state — network bridging is configured for failover. Single-VIOS scan: confirm the partner VIOS's SEA state (on the other LPAR) to prove the pair. Fix: n/a |
| Shared Storage Pool cluster | PASS | low | cluster + 3 node(s) report OK | The Shared Storage Pool / CAA cluster and its nodes report OK — the shared pool backing client disks is healthy on this VIOS's view. Fix: n/a |
| Check | Status | Sev | Observed | What it means & how to fix |
|---|---|---|---|---|
| SSH ciphers | PASS | high | chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes128-ctr | sshd offers only strong ciphers. Fix: n/a |
| SSH root login | PASS | med | permitrootlogin prohibit-password | Direct SSH root login is disabled — admins log in as themselves and escalate. Fix: n/a |
| Default password policy | PASS | med | maxage=8 minlen=8 loginretries=3 histsize=20 | The default password rules meet a baseline. Fix: n/a |
| UID 0 accounts | PASS | med | root only | root is the only UID 0 account. Fix: n/a |
| Failed login attempts | PASS | low | 3 recorded | Failed-login volume is low. Fix: n/a |
| Cleartext inetd services | PASS | med | none enabled | No cleartext remote-access services are enabled in inetd. Fix: n/a |
| Trust files (.rhosts) | PASS | low | none present | No .rhosts or hosts.equiv trust files present. Fix: n/a |
| World-writable files | PASS | low | none in /etc, /usr/local/bin | No world-writable files in the scanned directories (scope bounded to /etc and /usr/local/bin). Fix: n/a |
| SNMP community strings | PASS | low | no default community | No default public/private SNMP community strings configured. Fix: n/a |
| Audit subsystem | PASS | med | auditing on | The audit subsystem is running — you can answer 'who did what'. Fix: n/a |
| Trusted Execution | PASS | low | TE=ON | Trusted Execution is enabled — the kernel checks binary integrity at load. Fix: n/a |
| Login banner | PASS | low | herald set | A login banner is configured. Fix: n/a |
| Account password aging | PASS | low | no non-system account with maxage=0 (1 locked) | Every non-system account has password aging set. Fix: n/a |
| Unexpected setuid/setgid files | PASS | low | none in /home /tmp /var/tmp /usr/local | No setuid/setgid files outside the system paths. Fix: n/a |
| Listening network sockets | PASS | low | 8 listening socket(s) | Each listening socket is attack surface — review anything you do not recognize. Fix: n/a |
| root account controls | PASS | med | rlogin=false, sugroups=sysadmin | root's OS account gates are restricted: direct network root login is off and su to root is limited (not sugroups=ALL). Fix: n/a |
| Stale privileged accounts | PASS | low | 2 privileged account(s), none stale | Every privileged account has been used within 90 days (or is locked); no dormant standing-privilege accounts with non-expiring passwords. Fix: n/a |
| Privilege delegation (sudo/RBAC) | PASS | low | sudo installed; no NOPASSWD or blanket ALL grants | sudo is installed and its grants require a password and are not blanket ALL=(ALL) ALL — delegation is scoped and accountable. Fix: n/a |
| Network exposure vs filtering | PASS | med | 7 external listener(s); host IP filtering active | There are 7 externally-reachable listeners, but AIX IP Security packet filtering is active — the host enforces its own access control, not just the upstream perimeter. Fix: n/a |
| STIG file permissions | PASS | med | 11 of 11 rules compliant, 0 not applicable | Every applicable STIG file-permission/ownership rule (DISA STIG for IBM AIX 7.x) passes on this box — the mandated files are no more permissive than required. Fix: n/a |
| STIG account policy | PASS | med | 13 of 13 rules compliant, 0 n/a | Every applicable STIG account/password-policy attribute meets the DISA STIG for IBM AIX 7.x required value. Fix: n/a |
| STIG network tunables | PASS | med | 4 of 4 rules compliant, 0 n/a | Every applicable STIG network-option tunable (DISA STIG for IBM AIX 7.x) is at its required value. Fix: n/a |
| STIG disabled services | PASS | med | 37 of 37 rules compliant, 0 n/a | Every legacy network service the DISA STIG for IBM AIX 7.x requires disabled is off on this box. Fix: n/a |
| Check | Status | Sev | Observed | What it means & how to fix |
|---|---|---|---|---|
| Time synchronization (NTP) | PASS | med | xntpd active, 2 server(s) | The clock is disciplined by NTP — log correlation, Kerberos and TLS all depend on it. Fix: n/a |
| DNS resolver | PASS | low | 2 nameserver(s) | At least one DNS resolver is configured. Fix: n/a |
| Default route | PASS | low | default route present | A default route is configured. Fix: n/a |
| Kernel tunables (nextboot) | PASS | low | no non-default tunables | No non-default kernel tunables set for next boot. Fix: n/a |
| Timezone (TZ) | PASS | low | TZ=US/Central | The system timezone is set explicitly. Fix: n/a |
| Host self-resolution | PASS | low | resolves | The host can resolve its own name. Fix: n/a |
| Check | Status | Sev | Observed | What it means & how to fix |
|---|---|---|---|---|
| Monitoring agent | PASS | med | njmon running | A monitoring agent is running — findings on this box can reach someone automatically. Fix: n/a |
| Error notification | PASS | low | 7 errnotify stanzas | Custom error-notification methods exist beyond the defaults — errors can page a human. Fix: n/a |
| Remote syslog | PASS | low | 2 forwarding rule(s) | syslog forwards to a remote collector — logs survive the box. Fix: n/a |
| Performance history | PASS | low | collector running | A performance-history collector is running — sizing and incident forensics have data to work from. Fix: n/a |
| Scheduled backup job | PASS | med | backup job scheduled | root's crontab schedules a backup — the mksysb has an owner and a cadence. Fix: n/a |