topic Re: hostnmae changed in Operating System - HP-UX

hostnmae changed

Ajin_1 — Wed, 11 Dec 2013 06:10:07 GMT

Hi Experts ,

Some user changed the hostnmae of our server ,We have checked the history file and we are not able to trace the same

Any other options to find who did the same.Because of this cluster package went down.

there are no error message in syslog on when the cluster package went down ,

Does hostname change cause the cluster package Halt

Does this depend which parameter in cluster configuration file.

P.S. This thread has been moved from HP-UX>System Administration to HP-UX > Serviceguard. -HP Forum Moderator

Re: hostnmae changed

Patrick Wallek — Wed, 11 Dec 2013 17:34:50 GMT

I can see where a change in the host name could adversely affect the cluster.

The only user that can reset / change the host name is 'root'.

For example:

$ hostname
bp1
$ hostname bp2
You must be superuser to set the hostname

If you have multiple system administrators with root access, then you may never know who precisely made the change.

Check the root command history file for any occurrences of the hostname command.

Re: hostnmae changed

Bill Hassell — Thu, 12 Dec 2013 01:37:09 GMT

Patrick is correct. Someone has the root password but is not properly trained or lacks experience as a system administrator. SInce it sounds like this system is important enough to have the expensive Service Guard software, it will need a much higher level of accountability for root user actions. The best way to do this is to remove direct root access for everyone and use sudo for all root commands. This will log all attempts to perform a root level command as well as the incoming connection.

Note also that the errant root user may not have typed the hostname command but may have run sam or smh. Both of these tools have logs that can be searched. You should also check sulog for a possible connection.

Re: hostnmae changed

bingoarunprasat — Thu, 26 Dec 2013 10:23:56 GMT

Hi Ajin,

Check your package log file. It exactly shows what caused the package to halt and when it halted.

Yes, host name changes cause the package to halt.

'cmclnodelist' file and 'node_name' values in package configuration files are the parameters which contains node names.

Regards,

Arun