system_cmds-279.1.tar.gz

[apple/system_cmds.git] / sadc.tproj / sadc.c

/*
 * Copyright (c) 2003 Apple Computer, Inc. All rights reserved.
 *
 * @APPLE_LICENSE_HEADER_START@
 * 
 * "Portions Copyright (c) 1999 Apple Computer, Inc.  All Rights
 * Reserved.  This file contains Original Code and/or Modifications of
 * Original Code as defined in and that are subject to the Apple Public
 * Source License Version 1.0 (the 'License').  You may not use this file
 * except in compliance with the License.  Please obtain a copy of the
 * License at http://www.apple.com/publicsource and read it before using
 * this file.
 * 
 * The Original Code and all software distributed under the License are
 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT.  Please see the
 * License for the specific language governing rights and limitations
 * under the License."
 * 
 * @APPLE_LICENSE_HEADER_END@
 */

#define IOKIT   1       /* to get io_name_t in device_types.h */

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <ctype.h>
#include <time.h>
#include <err.h>
#include <fcntl.h>
#include <errno.h>
#include <kvm.h>
#include <mach/mach.h>
#include <mach/mach_error.h>
#include <sys/param.h>

#include <CoreFoundation/CoreFoundation.h>
#include <IOKit/IOKitLib.h>
#include <IOKit/storage/IOBlockStorageDriver.h>
#include <IOKit/storage/IOMedia.h>
#include <IOKit/IOBSD.h>

#include <sys/socket.h>
#include <net/if.h>
#include <net/if_var.h>

#include <sadc.h>

extern int errno;

FILE *data_fp = (FILE *)0;	/* raw data output file pointer */


#define REVISION_HISTORY_DATE 20030718

struct record_hdr restart_record = { SAR_RESTART, REVISION_HISTORY_DATE, 0, 0 };
struct record_hdr timestamp_record = { SAR_TIMESTAMP, 1, 0, 0 };
struct record_hdr vmstat_record = {SAR_VMSTAT, 1, 1, 0 };
struct record_hdr cpu_record = {SAR_CPU, 1, 1, 0 };
struct record_hdr drivestats_record = {SAR_DRIVESTATS, 1, 0, 0 };
struct record_hdr drivepath_record = {SAR_DRIVEPATH, 1, 1, 0 };
struct record_hdr netstats_record = {SAR_NETSTATS, 1, 0, 0};

/* Compile for verbose output */

int t_interval = 0; 	/* in seconds */
int n_samples  = 1;	/* number of sample loops */
char *ofile = NULL;     /* output file */
int ofd;		/* output file descriptor  */
static mach_port_t myHost;
static mach_port_t masterPort;

/* internal table of drive path mappings */
struct drivepath *dp_table = NULL;

/* number of entries in the dp_table */
int dp_count = 0;

/* internal table of network interface statistics */
struct netstats *ns_table = NULL;
int ns_count = 0;

static kvm_t *kvmd;
static struct nlist nlist_net[2];
int kvm_init_failed = 0;

static uid_t realuid;

int network_mode = 0;

/* Forward fuction declarations */
static void exit_usage();
static void open_datafile(char *);
static void write_record_hdr(struct record_hdr *);
static void write_record_data(char *, int);
static void get_all_stats();
static void get_vmstat_sample();
static void get_drivestat_sample();
static int get_ndrives();
static int record_device(io_registry_entry_t, struct drivestats *, int ndrives);
static int check_device_path (char *name, char *path, int ndrives);
static void get_netstat_sample(int pppflag);
static int kvm_init();
static int kread(u_long addr, void *buf, size_t nbytes);

int
main(argc, argv)
    int argc;
    char *argv[];
{

    char        *p;
    char	ch;
    
    /*
     * Stop being root ASAP.
     */
    if (geteuid() != 0)
    {
	fprintf(stderr, "sadc: must be setuid root or root");
	exit(1);
    }
    
    realuid = getuid();
    seteuid(realuid);

    setvbuf(stdout, (char *)NULL, _IONBF, 0);

    while ((ch=getopt(argc, argv, "m:")) != EOF) {
	switch(ch) {
	case 'm':
	    /* Only the PPP mode matters on this collector side   */
	    /* The reporter side deals with the DEV or EDEV modes */
	    if (!strncmp(optarg, "PPP", 3))
		network_mode |= NET_PPP_MODE;
	    break;
	default:
	    exit_usage();
	    break;
	}
    }

    argc -= optind;
    if (argc > 0)
    {
	if (isdigit(*argv[optind]))
	{
	    /* we expect to have both an interval and a sample count */
	    errno=0;
	    t_interval = strtol(argv[optind], &p, 0);
	    if (errno || (*p !='\0') || t_interval <= 0)
	    {
		exit_usage();
	    }

	    optind++;
	    if ((argc < 2) || (!isdigit(*argv[optind]))) {
		exit_usage();
	    }	
	    
	    errno=0;
	    n_samples = strtol(argv[optind], &p, 0);
	    if (errno || (*p != '\0') || n_samples <= 0)
	    {
		exit_usage();
	    }

	    optind++;
	    if (argc == 3)
	    {
		/* we have an output file */
		ofile = argv[optind];
	    }
	}
	else
	{
	    /* all we have is an output file */
	    ofile = argv[optind];
	}
    }

    
    /* open the output file */
    (void)open_datafile(ofile);

    /*
     * Get the Mach private port.
     */ 
    myHost = mach_host_self();
    
    /*
     * Get the I/O Kit communication handle.
     */
    IOMasterPort(bootstrap_port, &masterPort);
    

    restart_record.rec_timestamp = time((time_t *)0);
    write_record_hdr(&restart_record);
    get_all_stats();   /* this is the initial stat collection */
    sleep(t_interval);

    if (n_samples > 0)
    {
	/* this init sample is not counted */
	timestamp_record.rec_data = time((time_t *)0); /* returns time in
						       * seconds */
#if 0
	    struct tm *tm;
	    tm = gmtime(&(timestamp_record.rec_data));
	    fprintf(stderr, "timestamp=%ld\n", timestamp_record.rec_data);
	    fprintf(stderr, "GMTIME offset from UTC in seconds = %ld\n", tm->tm_gmtoff);
	    fprintf(stderr, "GMTIME secnds=%d, min=%d, hour=%d\n", tm->tm_sec, tm->tm_min, tm->tm_hour);
	    fprintf(stderr, "asctime = %s\n", asctime(tm));

	    tm=localtime(&(timestamp_record.rec_data));
	    fprintf(stderr, "LOCTIME offset from UTC in seconds = %ld\n",tm->tm_gmtoff);
	    fprintf(stderr, "LOCTIME secnds=%d, min=%d, hour=%d\n", tm->tm_sec, tm->tm_min, tm->tm_hour);
	    fprintf(stderr, "asctime = %s\n", asctime(tm));
#endif

	write_record_hdr(&timestamp_record);
	get_all_stats();
    }

    while (n_samples)
    {
	sleep(t_interval);
	timestamp_record.rec_timestamp = time((time_t *)0); /* returns time in
							     * seconds */
	write_record_hdr(&timestamp_record);
	get_all_stats();
	n_samples--;
    }
    exit(EXIT_SUCCESS);
}

static void
exit_usage()
{
    fprintf(stderr, "/usr/lib/sa/sadc [-m {PPP}] [t n] [ofile]\n");
    exit(EXIT_FAILURE);
}

static void
open_datafile(char *path)
{
    if (path == NULL)
    {
	data_fp = stdout;
	return;
    }
    else
	data_fp = fopen(path, "w+");

    if (!data_fp)
    {
	/* failed to open path */
	fprintf(stderr, "sadc: failed to open data file [%s]\n", path?path:"stdout");
	exit_usage();
    }
}

static void
write_record_hdr(hdr)
    struct record_hdr *hdr;
{
    errno = 0;
    
    if (fwrite(hdr, sizeof(struct record_hdr), 1, data_fp) != 1)
    {
	fprintf(stderr, "sadc: write_record_hdr failed, errno=%d\n", errno);
	exit(EXIT_FAILURE);
    }

    fflush(data_fp);
    return;
}

static void
write_record_data(data, size)
    char *data;
    int  size;
{
    errno = 0;

    if (fwrite(data, size, 1, data_fp) != 1)
    {
	fprintf(stderr, "sadc: write_record_data failed, errno=%d\n", errno);
	exit(EXIT_FAILURE);
    }

    fflush(data_fp);    
    return;	
}


static void
get_vmstat_sample()
{    
    struct vm_statistics    stat;
    kern_return_t           error;    
    mach_msg_type_number_t  count;

    count = HOST_VM_INFO_COUNT;
    error = host_statistics(myHost, HOST_VM_INFO, (host_info_t)&stat, &count);
    if (error != KERN_SUCCESS) {
	fprintf(stderr, "sadc: Error in vm host_statistics(): %s\n",
	  mach_error_string(error));
	exit(2);
    }
    
    vmstat_record.rec_count = 1;
    vmstat_record.rec_size = sizeof(vm_statistics_data_t);
    write_record_hdr(&vmstat_record);
    write_record_data((char *)&stat, sizeof(vm_statistics_data_t));    
}

static void
get_cpu_sample()
{
    host_cpu_load_info_data_t    cpuload;
    kern_return_t           error;
    mach_msg_type_number_t  count;

    count = HOST_CPU_LOAD_INFO_COUNT;
    error = host_statistics(myHost, HOST_CPU_LOAD_INFO,(host_info_t)&cpuload, &count);
    if (error != KERN_SUCCESS) {
	fprintf(stderr, "sadc: Error in cpu host_statistics(): %s",
	  mach_error_string(error));
	exit(2);
    }

    cpu_record.rec_count = 1;
    cpu_record.rec_size = sizeof(host_cpu_load_info_data_t);
    write_record_hdr(&cpu_record);
    write_record_data((char *)&cpuload, sizeof(host_cpu_load_info_data_t));
}

static void
get_drivestat_sample()
{
    io_registry_entry_t     drive;
    io_iterator_t           drivelist;
    CFMutableDictionaryRef match;
    int			    ndrives;
    int			    i = 0;
    long 		    bufsize = 0;
    char 	 	    *buf;
    struct drivestats       *dbuf;
    kern_return_t           status;
    int error;

    if ((ndrives = get_ndrives()) <= 0)
	return;

    /* allocate space to collect stats for all the drives */
    bufsize = ndrives * sizeof(struct drivestats);
    buf  = (char *) malloc (bufsize);
    dbuf = (struct drivestats *)buf;    
    if (buf)
	bzero((char *)buf, bufsize);	
    else
	return;
	
    /*
     * Get an iterator for IOMedia objects.
     */
    match = IOServiceMatching("IOMedia");
    
    /* Get whole disk info */
    CFDictionaryAddValue(match, CFSTR(kIOMediaWholeKey), kCFBooleanTrue);
    
    status = IOServiceGetMatchingServices(masterPort, match, &drivelist);
    if (status != KERN_SUCCESS)
	goto RETURN;

    /*
     * Scan all of the IOMedia objects, and for each
     * object that has a parent IOBlockStorageDriver,
     * record the statistics
     *
     * XXX What about RAID devices?
     */
    error = 1;
    i = 0;
    while ((drive = IOIteratorNext(drivelist)))
    {
	if (i < ndrives)
	{
	    if (record_device(drive, &dbuf[i], ndrives))
	    {
		error = 0;
		i++;
	    }
	}
	else
	{
	    IOObjectRelease(drive);
	    break;
	}
	IOObjectRelease(drive);
    }
    IOObjectRelease(drivelist);

    if (! error)
    {
	drivestats_record.rec_count = i;
	drivestats_record.rec_size = sizeof (struct drivestats);
	write_record_hdr(&drivestats_record);
	write_record_data((char *)buf, (i * sizeof(struct drivestats)));
    }

    RETURN:
    if (buf)
	free(buf);
    return;
}

/*
 * Determine whether an IORegistryEntry refers to a valid
 * I/O device, and if so, record it.
 * Return zero: no device recorded
 * Return non-zero: device stats recorded
 */
static int
record_device(io_registry_entry_t drive, struct drivestats* drivestat, int ndrives)
{
    io_registry_entry_t parent;
    CFDictionaryRef properties, statistics;
    CFStringRef name;
    CFNumberRef number;
    UInt64                  value;
    kern_return_t status;
    int retval = 0;
    int drive_id;
    io_string_t path;
    char        BSDName[MAXDRIVENAME + 1];

    status = IORegistryEntryGetParentEntry(drive, kIOServicePlane, &parent);
    if (status != KERN_SUCCESS)
    {
	/* device has no parent */
	return(retval);
    }

    if (IOObjectConformsTo(parent, "IOBlockStorageDriver"))
    {
	/*
	 * Get a unique device path identifier.
	 * Devices available at boot have an Open Firmware Device Tree path.
	 * The OF path is short and concise and should be first choice.
	 * Devices that show up after boot, are guaranteed to have
	 * a Service Plane, hardware unique path.
	 */

        bzero(path, sizeof(io_string_t));
	if (IORegistryEntryGetPath(drive, kIODeviceTreePlane, path) != KERN_SUCCESS)
	{
	    if(IORegistryEntryGetPath(drive, kIOServicePlane, path) != KERN_SUCCESS)
		/* device has no unique path identifier */
		goto RETURN;
	}
	retval++;

	/* get drive properties */
	status = IORegistryEntryCreateCFProperties(drive,
	  (CFMutableDictionaryRef *)&properties,
	  kCFAllocatorDefault,
	  kNilOptions);
	if (status != KERN_SUCCESS)
	{
            /* device has no properties */
	    goto RETURN;
	}

	bzero(BSDName, MAXDRIVENAME+1);
	/* get name from properties */
	name = (CFStringRef)CFDictionaryGetValue(properties,
	  CFSTR(kIOBSDNameKey));
	if (name) {
	    CFStringGetCString(name, BSDName,
	      MAXDRIVENAME, CFStringGetSystemEncoding());
	    retval++;
	}

	/* get blocksize from properties */
	number = (CFNumberRef)CFDictionaryGetValue(properties,
	  CFSTR(kIOMediaPreferredBlockSizeKey));
	if (number != 0) {
	    CFNumberGetValue(number,
	      kCFNumberSInt64Type, &value);
	    drivestat->blocksize = value;
	    retval++;	    
	}
	CFRelease(properties);
    }
    else
	goto RETURN;

    /* we should have a name and blocksize at a minimum */
    if (retval != 3)
    {
	retval = FALSE;
	goto RETURN;
    }

    drive_id = check_device_path (BSDName, path, ndrives);
    if (drive_id == -1)
    {
	retval = FALSE;
	goto RETURN;
    }
    else
	drivestat->drivepath_id = drive_id;


    /* get parent drive properties */
    status = IORegistryEntryCreateCFProperties(parent,
      (CFMutableDictionaryRef *)&properties,
      kCFAllocatorDefault,
      kNilOptions);
    if (status != KERN_SUCCESS)
    {
        /* device has no properties */
	goto RETURN;
    }
    
    /* Obtain the statistics from the parent drive properties. */
    
    statistics
      = (CFDictionaryRef)CFDictionaryGetValue(properties,
      CFSTR(kIOBlockStorageDriverStatisticsKey));

    if (statistics != 0)
    {
	/* Get number of reads. */
	number =
	  (CFNumberRef)CFDictionaryGetValue(statistics,
	  CFSTR(kIOBlockStorageDriverStatisticsReadsKey));
	if (number != 0) {
	    CFNumberGetValue(number,
	      kCFNumberSInt64Type, &value);
	    drivestat->Reads = value;
	}

	/* Get bytes read. */
	number =
	  (CFNumberRef)CFDictionaryGetValue(statistics,
	  CFSTR(kIOBlockStorageDriverStatisticsBytesReadKey));
	if (number != 0) {
	    CFNumberGetValue(number, kCFNumberSInt64Type, &value);
	    drivestat->BytesRead = value;
	}
		
	/* Get number of writes. */
	number =
	  (CFNumberRef)CFDictionaryGetValue(statistics,
	  CFSTR(kIOBlockStorageDriverStatisticsWritesKey));
	if (number != 0) {
	    CFNumberGetValue(number, kCFNumberSInt64Type, &value);
	    drivestat->Writes = value;
	}

	/* Get bytes written. */
	number =
	  (CFNumberRef)CFDictionaryGetValue(statistics,
	  CFSTR(kIOBlockStorageDriverStatisticsBytesWrittenKey));
	if (number != 0) {
	    CFNumberGetValue(number, kCFNumberSInt64Type, &value);
	    drivestat->BytesWritten = value;
	}

	/* Get LatentReadTime. */
	number =
	  (CFNumberRef)CFDictionaryGetValue(statistics,
	  CFSTR(kIOBlockStorageDriverStatisticsLatentReadTimeKey));
	if (number != 0) {
	    CFNumberGetValue(number, kCFNumberSInt64Type, &value);
	    drivestat->LatentReadTime = value;
	}

	/* Get LatentWriteTime. */
	number =
	  (CFNumberRef)CFDictionaryGetValue(statistics,
	  CFSTR(kIOBlockStorageDriverStatisticsLatentWriteTimeKey));
	if (number != 0) {
	    CFNumberGetValue(number, kCFNumberSInt64Type, &value);
	    drivestat->LatentWriteTime = value;
	}

	/* Get ReadErrors. */
	number =
	  (CFNumberRef)CFDictionaryGetValue(statistics,
	  CFSTR(kIOBlockStorageDriverStatisticsReadErrorsKey));
	if (number != 0) {
	    CFNumberGetValue(number, kCFNumberSInt64Type, &value);
	    drivestat->ReadErrors = value;
	}

	/* Get WriteErrors. */
	number =
	  (CFNumberRef)CFDictionaryGetValue(statistics,
	  CFSTR(kIOBlockStorageDriverStatisticsWriteErrorsKey));
	if (number != 0) {
	    CFNumberGetValue(number, kCFNumberSInt64Type, &value);
	    drivestat->WriteErrors = value;
	}

	/* Get ReadRetries. */
	number =
	  (CFNumberRef)CFDictionaryGetValue(statistics,
	  CFSTR(kIOBlockStorageDriverStatisticsReadRetriesKey));
	if (number != 0) {
	    CFNumberGetValue(number, kCFNumberSInt64Type, &value);
	    drivestat->ReadRetries = value;
	}

	/* Get WriteRetries. */
	number =
	  (CFNumberRef)CFDictionaryGetValue(statistics,
	  CFSTR(kIOBlockStorageDriverStatisticsWriteRetriesKey));
	if (number != 0) {
	    CFNumberGetValue(number, kCFNumberSInt64Type, &value);
	    drivestat->WriteRetries = value;
	}

	/* Get TotalReadTime. */
	number =
	  (CFNumberRef)CFDictionaryGetValue(statistics,
	  CFSTR(kIOBlockStorageDriverStatisticsTotalReadTimeKey));
	if (number != 0) {
	    CFNumberGetValue(number, kCFNumberSInt64Type, &value);
	    drivestat->TotalReadTime = value;
	}

	/* Get WriteRetries. */
	number =
	  (CFNumberRef)CFDictionaryGetValue(statistics,
	  CFSTR(kIOBlockStorageDriverStatisticsTotalWriteTimeKey));
	if (number != 0) {
	    CFNumberGetValue(number, kCFNumberSInt64Type, &value);
	    drivestat->TotalWriteTime = value;
	}
	    
	CFRelease(properties);
    } /* end if statistics != 0 */

    RETURN:
    IOObjectRelease(parent);		    
    return(retval);
}


/*
 * find IOMedia objects
 * This routine always gives me a lower count on the number
 * of disks.  I don't know which one to use.
 */
static int
get_ndrives(void)
{
    io_iterator_t drivelist;
    io_registry_entry_t drive;
    io_registry_entry_t parent;    
    CFMutableDictionaryRef match;
    int error, ndrives;
    kern_return_t status;

    /*
     * Get an iterator for IOMedia objects.
     */
    match = IOServiceMatching("IOMedia");
    CFDictionaryAddValue(match, CFSTR(kIOMediaWholeKey), kCFBooleanTrue);
    status = IOServiceGetMatchingServices(masterPort, match, &drivelist);
    if (status != KERN_SUCCESS)
	return(0);

    /*
     * Scan all of the IOMedia objects, and count each
     * object that has a parent IOBlockStorageDriver
     *
     * XXX What about RAID devices?
     */
    error = 1;
    ndrives = 0;
    while ((drive = IOIteratorNext(drivelist)))
    {
	/* get drive's parent */
	status = IORegistryEntryGetParentEntry(drive,
	  kIOServicePlane, &parent);
	if (status != KERN_SUCCESS)
	{
	    IOObjectRelease(drive);
	    continue;
	}

	if (IOObjectConformsTo(parent, "IOBlockStorageDriver"))
	{
	    error = 0;
	    ndrives++;
	}
	IOObjectRelease(parent);
	IOObjectRelease(drive);
    }
    
    IOObjectRelease(drivelist);

    return(ndrives);
}


/*
 * When getting the stats, do it in the order
 * of their type.  The types that have the most
 * data come first in the list if possible.
 * This makes the sar reporter tool more efficient,
 * because in some cases, it will allocate a buffer
 * and keep reusing it as long as the sample data fits.
 * When a sample data doesn't fit, it reallocates the buffer
 * to a bigger size etc.
 */
void
get_all_stats()
{

    get_drivestat_sample();
    get_netstat_sample(network_mode);
    get_vmstat_sample();
    get_cpu_sample();
}


/*
 * An internal table maps the BSDName to a unique ioregistry path.
 * The table's index is then used as a unique compressed path, and
 * helps track disks that come and go during the sampling intervals.
 * This routine finds an entry that maps both the BSDName and the
 * IOKit registry path.  If no mapping is discovered, a new entry
 * is created.  An entry is never removed, this maintaining the
 * unique index throughout the data collection.
 * Success returns the map index. Failure returns -1.
 */
static int 
check_device_path (char *name, char *path, int ndrives)
{
    int i;
    int index;
    int n;

    if (dp_table == NULL)
    {
	/* First setup of internal drivepath table */
	dp_table = (struct drivepath *)malloc (ndrives * sizeof(struct drivepath));
	if (dp_table == NULL)
	    return(-1);
	else
	{
	    bzero(dp_table, (ndrives * sizeof(struct drivepath)));
	    dp_count = ndrives;
	    drivepath_record.rec_size = sizeof(struct drivepath);
	}
    }

    for (i=0; i < dp_count; i++)
    {
	if (dp_table[i].state == DPSTATE_UNINITIALIZED)
	{
	    /* This is a new drive entry that should be recorded */
	    index = i;
	    goto NEW_ENTRY;
	}
	else if (!strcmp (dp_table[i].ioreg_path, path))
	{
	    /* Found a matching hardware path */
	    if (!strcmp(dp_table[i].BSDName, name))
	    {
		/* The BSDName matches the entry in the table
		 * so there is no need to record this data.
		 */
		return(i);
	    }
	    else
	    {
		/* The BSDName is different ... implies a change,
		 * like the drive was removed and now is back
		 */
		bzero((char *)dp_table[i].BSDName, MAXDRIVENAME+1);
		dp_table[i].drivepath_id = i;
		dp_table[i].state = DPSTATE_CHANGED;
		strcpy(dp_table[i].BSDName, name);
		write_record_hdr(&drivepath_record);
		write_record_data((char *)&dp_table[i], sizeof(struct drivepath));
		return(i);
	    }
	}
    } /* end for loop */
    
    /* 
     * If we reach this point, then we've run out of
     * table entries. Double the size of the table.
     */
    n = dp_count * 2;
    dp_table = (struct drivepath *)realloc(dp_table, n * sizeof(struct drivepath));
    bzero(&dp_table[dp_count], dp_count * sizeof(struct drivepath));
    index = dp_count;
    dp_count = n;

    /* This is a new drive entry that should be recorded */
    NEW_ENTRY:
    dp_table[index].drivepath_id = index;
    dp_table[index].state = DPSTATE_NEW;
    strcpy(dp_table[index].BSDName, name);
    strcpy(dp_table[index].ioreg_path, path);
    write_record_hdr(&drivepath_record);
    write_record_data((char *)&dp_table[index], sizeof(struct drivepath));  
    return(index);
}


/*
 * success - returns 1
 * failure - returns 0
 */
static int
kvm_init()
{
    int	retval = 1;
    char errbuf[_POSIX2_LINE_MAX];

	
	/*
	 * Initialize the kvm descriptor and get the location of _ifnet in
	 * preparation for gathering network statistics.
	 *
	 * We become root again momentarily so that we have permission to
	 * open /dev/kmem.
	 */
	if (seteuid(0))
	{
	    fprintf(stderr, "sar: root privleges denied\n");
	    retval = 0;
	    goto RETURN;
	}
	kvmd = kvm_openfiles(NULL, NULL, NULL, O_RDONLY, errbuf);
	setuid(realuid);
	
	if (kvmd == NULL) {
	    fprintf(stderr, "sar: error in kvm_openfiles(): %s", errbuf);
	    retval = 0;
	    goto RETURN;
	}
	nlist_net[0].n_name = "_ifnet";
	nlist_net[1].n_name = NULL;
	if (kvm_nlist(kvmd, nlist_net) < 0) {
	    fprintf(stderr,"sar: error in kvm_nlist(): %s", kvm_geterr(kvmd));
	    retval = 0;
	    goto RETURN;
	}
	if (nlist_net[0].n_type == N_UNDF) {
		fprintf(stderr, "sadc: No nlist for _ifnet");
		retval = 0;
		goto RETURN;
	}
    RETURN:
	return (retval);
}

/* Read data from kernel memory. */
static int
kread(u_long addr, void *buf, size_t nbytes)
{
    int retval = 0;

    if (kvm_read(kvmd, addr, buf, nbytes) != (ssize_t)nbytes) {
	fprintf(stderr, "sadc: error in kvm_read(): %s\n", kvm_geterr(kvmd));
	retval = 1;
    }

    return (retval);
}


/*
 * Thus far, only the networking stats take an optional flag
 * to modify the collection of data.  The number of ppp
 * interfaces can be very high, causing the raw data file to
 * grow very large.  We want this option to include ppp
 * statistics to be off by default.  When we see the -m PPP
 * mode passed in, ppp collection will be turned on.
 */
static void
get_netstat_sample(int mode)
{

    int n;
    int ns_index     = 0;
    struct ifnet            ifnet;
    struct ifnethead        ifnethead;
    u_long                  off;
    char                    tname[MAX_TNAME_SIZE + 1];
    char                    name[MAX_TNAME_UNIT_SIZE + 1];

    if (ns_table == NULL)
    {
	/* this is our first sample -- do some init */

	/* if kvm_init fails, we don't retry */
	if (kvm_init_failed || !kvm_init())
	{
	    kvm_init_failed = 1;
	    return;
	}

	/*
	 * Set the starting table size to 100 entries
	 * That should be big enough for most cases,
	 * even with a lot of ppp connections.
	 */
	ns_count = 100;
	ns_table = (struct netstats *) malloc(ns_count * sizeof (struct netstats));
	if (ns_table == NULL)
	{
	    fprintf(stderr, "sadc: malloc netstat table failed\n");
	    return;
	}
    }

    bzero(ns_table, ns_count * sizeof(struct netstats));
    if (nlist_net[0].n_value != 0
      && kread(nlist_net[0].n_value, &ifnethead, sizeof(ifnethead)) == 0)
    {
	for (ns_index = 0, off = (u_long)ifnethead.tqh_first;
	     off != 0;
	     off = (u_long)ifnet.if_link.tqe_next)
	{
	    if (kread(off, &ifnet, sizeof(ifnet)))
	    {
		break;
	    }
	    if (kread((u_long)ifnet.if_name, tname, sizeof(tname)))
	    {
		break;
	    }
	    tname[MAX_TNAME_SIZE] = '\0';
	    if (!(network_mode & NET_PPP_MODE))
	    {
		/*
		 * If the flag is set, include PPP connections.
		 * By default this collection is turned off
		 */
		if(!strncmp(tname, "ppp", 3))
		    continue;
	    }
	    snprintf(name, MAX_TNAME_UNIT_SIZE, "%s%d", tname, ifnet.if_unit);
	    name[MAX_TNAME_UNIT_SIZE] = '\0';

	    if (ns_index == ns_count)
	    {
		/* the stat table needs to grow */
		n = ns_count * 2;
		ns_table = (struct netstats *)realloc(ns_table, n * sizeof(struct netstats));
		bzero(&ns_table[ns_count], ns_count * sizeof(struct netstats));
		ns_count = n;
	    }


	    /*
	     * As a means of helping to identify when interface unit numbers
	     * are reused, a generation counter may eventually be implemented.
	     * This will be especially helpful with ppp-x connections.
	     * In anticipation, we will reserve a space for it, but always
	     * set it to zero for now.
	     */
	    ns_table[ns_index].gen_counter = 0;
	    
	    strncpy(ns_table[ns_index].tname_unit, name, MAX_TNAME_UNIT_SIZE);
	    ns_table[ns_index].tname_unit[MAX_TNAME_UNIT_SIZE] = '\0';
	    ns_table[ns_index].net_ipackets = ifnet.if_ipackets;
	    ns_table[ns_index].net_ierrors  = ifnet.if_ierrors;	    	    
	    ns_table[ns_index].net_opackets = ifnet.if_opackets;
	    ns_table[ns_index].net_oerrors  = ifnet.if_oerrors;
	    ns_table[ns_index].net_collisions = ifnet.if_collisions;	    
	    ns_table[ns_index].net_ibytes   = ifnet.if_ibytes;
	    ns_table[ns_index].net_obytes   = ifnet.if_obytes;	    
	    ns_table[ns_index].net_imcasts   = ifnet.if_imcasts;
	    ns_table[ns_index].net_omcasts   = ifnet.if_omcasts;
	    ns_table[ns_index].net_drops      = ifnet.if_snd.ifq_drops;
	    ns_index++;
	}  /* end for */

	netstats_record.rec_count = ns_index;
	netstats_record.rec_size = sizeof(struct netstats);
	write_record_hdr(&netstats_record);
	write_record_data((char *)ns_table, (ns_index * sizeof(struct netstats)));
    } /* end if */
    return;
}