topic Re: Logging - Kernel Parameter changes in Operating System - HP-UX

Logging - Kernel Parameter changes

walter crasto_1 — Fri, 10 Feb 2006 16:16:01 GMT

Hi,

I have IA64 HP-UX system with OS HP-UX 11.23
It seems some one has change the kernel parameters. After words we have also done chages in kernel parameter in month of Jan.

Need to find out followings,
1> How many number of times the kernel parameters has been change in last 6 months.
2> What are the parameters has been change & who has made the changes.
3> If any other relevant information.

Thanks in advance.

Regards

Varian Crasto

Re: Logging - Kernel Parameter changes

Jeff_Traigle — Fri, 10 Feb 2006 16:36:40 GMT

Nothing built-in to the OS that will track this... unless auditing in Trusted system would help... even that won't tell you everything in itself, I think.

What changes were made would need to be monitored by running kmtune for a listing periodically and svaing them to compare. (Or maybe compare automatically what is running vs. what you have archived as what should be running.) Only root can make changes and rebuild kernels so, unless you have direct root logins disabled, including at the console, you may not be able to track down who specifically makes the changes.

Re: Logging - Kernel Parameter changes

Rick Garland — Fri, 10 Feb 2006 17:10:59 GMT

This is not recorded by the OS.

This is best kept as some kind of change control process.

Any changes (such as kernel changes) is documentated and presented. The change will be OK'd or DC'd and then recorded as part of the change control process.

Re: Logging - Kernel Parameter changes

Carlos Roberto Schimidt — Sat, 11 Feb 2006 10:58:56 GMT

In HP-UX 11.23 all changes from kernel parameter are record in file /var/adm/kc.log

For example:

======================================================================

Change to configuration 'nextboot'
at 14:10:33 GMTLA on 20 January 2006 by root:
Tunable 'shmmax' changed from '34359738368' to '68719476736'.

See too:

# man kclog

Good luck

Re: Logging - Kernel Parameter changes

Steven E. Protter — Sat, 11 Feb 2006 12:14:06 GMT

Shalom Varian,

You can write a script that does manual kernel production and keeps copies of the system file with the date appended.

Thats what I did when I was called upon to track that stuff at my prior job.

SEP

Re: Logging - Kernel Parameter changes

Sanjay Yugal Kishore Ha — Sun, 12 Feb 2006 10:43:04 GMT

Hi,

Try kclog command for most your needs for #s 1 and 2.

For other relevant information, you can bring up the Kernel Configuration web interface by typing http://:2301 on your browswer.

HTH,
Sanjay

Re: Logging - Kernel Parameter changes

Muthukumar_5 — Mon, 13 Feb 2006 01:41:14 GMT

1> How many number of times the kernel parameters has been change in last 6 months.
2> What are the parameters has been change & who has made the changes.
3> If any other relevant information.

To answer this 3 question,

If you are having history logs for 6 months which will give details on changes by command line using kmtune or kctune.

May be sam log will give that too.

--
Muthu

Re: Logging - Kernel Parameter changes

walter crasto_1 — Mon, 13 Feb 2006 15:29:02 GMT

Hi All,

Thanks a lot for your responses.
Please let me know in future if I need to track the kernel parameter changes then what will be the best options.
1> Make system in auditing mode ?
or
2> Take system file backup with date append.
or
3> Use kmtune command.

Thanks & regards

Varian Crasto

Re: Logging - Kernel Parameter changes

Geoff Wild — Mon, 13 Feb 2006 15:52:24 GMT

With iiiv2, you can use kcweb - allows you to put a comment in place for each parameter that you change.

Rgds...Geoff

Re: Logging - Kernel Parameter changes

walter crasto_1 — Mon, 13 Feb 2006 17:30:26 GMT

Hi Geoff,

Can you please let me know how & when I can put the comments ?

Also what is iiiv2 ? I am not aware of this.

Regards

Varian

Re: Logging - Kernel Parameter changes

Carlos Roberto Schimidt — Mon, 13 Feb 2006 18:14:31 GMT

Hi Walter,

Is HP-UX 11iv2 not iiv2. Same as 11.23.

In this version you have to use kctune instead kmtune.

For add comments:

# kctune nproc=8192 -d "Subject for change"

Regards

Carlos Schimidt