rpcd process dies without warning/explaination

[Tony Kuehn]

I have several servers that the rpcd process will die several hours after the process is started. The time the process stays up varies. This is happening on both HPUX 10.20 and HPUX 11.i. All systems are running MWA C.03.50 and ITO agent version 7 (I have heard both applications can cause issues with rpcd??).
I have verified that the suggested DCE patch is installed (PHSS_19739 10.20 and PHSS_27962 11.i).
There is no core files created from the process dying in /opt/dce/bin or /opt/dce/sbin. The log files in /var/opt/dce/svc are "some times" updated when this happens.
We do see issues with ITO after this happens, here is the messages that we see in /var/opt/OV/log/OpC/opcerror:

09/12/03 11:21:26 WARNING opcctla (Control Agent)(28932) [genctla.c:7694]: Can't connect to the VPO control agent. Check
whether the llbd (if NCS) / rpcd (if DCE) runs on the node.
In case everything is running, please check whether the
setting for OPC_IP_ADDRESS is correct on multi homed hosts. (OpC30-1044)

Rebooting the system or stopping and restarting rpcd/dce will only correct the symptoms for less than 24 hours.

Please advise any suggests or next steps to isolate the cause of this problem.
Thanks!!

[Mark Grant]

I believe the blaster worm does this to rpcd

[John Bolene]

your machines are available to some Windows box that has been infected with the Blaster worm

We have been battleing this worm for 2 weeks and it may end up as a task force that visits every single window machine and verifies that Norton is installed and current, and that all Microsoft patches are current.

It got into our corporate network thru users opening their personal email on unprotected computers.

Good luck in your quest.

We have put in a cron job that runs once an hour to check that rpcd is running and start it if it is not.

[Tony Kuehn]

This could be! As we run ASU on several of the systems that are having the problem! The other two machines that are having the problem are B-class workstations that are unfortunately somewhat overlooked when it comes to maintance and patches.
Our Windows team has cleaned all windows PC's of the worm (they believe!).
What do I need to do on the HPUX side of things to resolve this issue?????
Please advise, thanks.

[John Bolene]

HP is still working on patches.

They have not decided if they will release them for 10.20, but will relesse them for 11 and up.

So just restart the rcpd at this time.

And if your UNIX machines are not accessible from outside, you still have some Blasters running around internally.

[R.O.]

Hi,

I´m having the same problem (rpcd dies). But, where is an official HP site where get the info about this issue, recomended patches, actions, etc?

Thxs in advance,

R.

[Alan Turner]

Official HP site for information about security problems would be the ITRC.
Go to Notifications --> Support Information digests.
That page gives you the option to subscribe to the daily HP-UX security bulletin digests - do this, and click on update subscriptions.
Then drag down to the bottom of the page - you should see a link to "Security Bulletins Archive" or something like that. Take that link, and you can see all the HP security bulletins, plus a further link to the patch matrix, which lists (almost) all the Security bulletins and the patches you should have for them.
As far as DEC / rpcd problems are concerned, recent bulletins are 273 and 276, also perhaps 274.

[Ashwani Kashyap]

We had the same problem on our 10.20 and 11.0 boxes when the blaster worm hit . rpcd would die .

The problem was resolved after we installed the follwoing DCE patches .:

11.0 PHSS_17810 or superceded .
10.20 PHSS_19739 .
THese patches pathces have special intallation instructions .

We didn;t have to do anything for the 11i systems . They were fine .

For more information go to
http://support.openview.hp.com/support