topic Re: RPC: Unkown host in Operating System - HP-UX

RPC: Unkown host

D Block 2 — Mon, 13 Sep 2004 16:41:03 GMT

I getting lots of messages:

Sep 13 11:53:01 MYSYSTEM automountd[1094]: phooey : RPC: Unknown host
Sep 13 12:01:16 MYSYSTEM automountd[1094]: phooey : RPC: Unknown host
Sep 13 12:02:13 MYSYSTM automountd[1094]: phooey : RPC: Unknown host
Sep 13 12:15:18 MYSYSTEM automountd[1094]: phooey : RPC: Unknown host

in Syslog, but don't know what is host named: PHOOEY" ??

How can I delete this entry to PHOOEY ??

Re: RPC: Unkown host

Sridhar Bhaskarla — Mon, 13 Sep 2004 17:02:43 GMT

Hi Tom,

Look at your /etc/auto_master file and the files pointed to by it. There should be entries corresponding to this host.

-Sri

Re: RPC: Unkown host

Dave Olker — Mon, 13 Sep 2004 17:16:49 GMT

Hi Tom,

As Sridhar wrote, /etc/auto_master might tell you where to look next. However, if you're using NIS or NIS+ to distribute your AutoFS maps, you may need to use either ypcat or niscat to get the contents of your auto_master map. Once you have the full auto_master map contents, from which ever repository holds them, you can determine which direct or indirect maps contain the reference to server "phooey".

However, it is easily possible to see this error message in syslog even if your AutoFS maps do not contain any reference to a server named "phooey". If you are using the standard AutoFS map entry:

/net -hosts

then all someone on the client has to do is issue the command:

# ls /net/phooey

and you'll get this error message, or something very similar to it.

In fact, any reference to /net/phooey will likely generate this message (i.e. not just an ls of the directory) regardless of whether your AutoFS maps directly contain a reference to a server named "phooey". Perhaps some script on your system is referencing the path "/net/phooey"?

Just something else to consider in case your AutoFS maps don't contain a server named "phooey".

Regards,

Dave

Re: RPC: Unkown host

D Block 2 — Mon, 13 Sep 2004 19:47:04 GMT

Sri & Dave,

thanks for your inputs...

cat /etc/auto_master
/net -hosts nosuid,soft,rsize=32768,wsize=32768

ls /net/phooey
did reproduce the error in syslog, great!!

Is there something else I should be looking for ? The last 2 messages are from me below..

Sep 13 06:04:25 MYSYSTEM automountd[1094]: phooey : RPC: Unknown host
Sep 13 06:05:21 MYSYSTEM automountd[1094]: phooey : RPC: Unknown host
Sep 13 06:07:32 MYSYSTEM automountd[1094]: phooey : RPC: Unknown host
Sep 13 06:08:28 MYSYSTEM automountd[1094]: phooey : RPC: Unknown host
Sep 13 07:41:12 MYSYSTEM automountd[1094]: phooey : RPC: Unknown host
Sep 13 07:42:08 MYSYSTEM automountd[1094]: phooey : RPC: Unknown host
Sep 13 07:43:40 MYSYSTEM automountd[1094]: phooey : RPC: Unknown host
Sep 13 07:44:37 MYSYSTEM automountd[1094]: phooey : RPC: Unknown host
Sep 13 09:52:43 MYSYSTEM automountd[1094]: phooey : RPC: Unknown host
Sep 13 09:53:40 MYSYSTEM automountd[1094]: phooey : RPC: Unknown host
Sep 13 11:52:04 MYSYSTEM automountd[1094]: phooey : RPC: Unknown host
Sep 13 11:53:01 MYSYSTEM automountd[1094]: phooey : RPC: Unknown host
Sep 13 12:01:16 MYSYSTEM automountd[1094]: phooey : RPC: Unknown host
Sep 13 12:02:13 MYSYSTEM automountd[1094]: phooey : RPC: Unknown host
Sep 13 12:15:18 MYSYSTEM automountd[1094]: phooey : RPC: Unknown host
Sep 13 12:16:15 MYSYSTEM automountd[1094]: phooey : RPC: Unknown host
Sep 13 14:05:25 MYSYSTEM automountd[1094]: phooey : RPC: Unknown host
Sep 13 14:06:22 MYSYSTEM automountd[1094]: phooey : RPC: Unknown host
Sep 13 14:23:40 MYSYSTEM automountd[1094]: phooey : RPC: Unknown host
Sep 13 14:24:37 MYSYSTEM automountd[1094]: phooey : RPC: Unknown host
Sep 13 14:30:52 MYSYSTEM automountd[1094]: phooey : RPC: Unknown host
Sep 13 14:31:49 MYSYSTEM automountd[1094]: phooey : RPC: Unknown host
Sep 13 16:31:52 MYSYSTEM automountd[1094]: phooey : RPC: Unknown host
Sep 13 20:41:40 MYSYSTEM automountd[1094]: phooey : RPC: Unknown host
Sep 13 20:44:41 MYSYSTEM automountd[1094]: phooey : RPC: Unknown host

Re: RPC: Unkown host

Dave Olker — Mon, 13 Sep 2004 21:37:39 GMT

Hi Tom,

What does your /etc/nsswitch.conf file look like, specifically the entry for automount? Does it only look at "files" - i.e. local files in /etc, or does it look at any other repository, like NIS or NIS+?

Also, can you cut/paste a copy of your /etc/mnttab file so I can see if there are any other "autofs" type entries in your /etc/mnttab file, as that will indicate that there are other maps being used other than the /net entry from your local auto_master file.

If your investigation still only shows the /net entry in /etc/auto_master then you're stuck trying to find out where these references to /net/phooey are coming from. Again, I'd start looking at scripts that run on the system at the same time as the entries are logged in /var/adm/syslog/syslog.log.

One other trick that might yield some additional information would be to send a SIGUSR2 signal to the running automountd process (i.e. kill -17 ). That will enable full debug logging into the file /var/adm/automount.log. Then monitor the /var/adm/syslog/syslog.log file and wait for another of these "phooey" errors to appear.

When you see another "phooey" entry added to syslog then send another SIGUSR2 signal to the running automountd pid to disable debug logging. Then either analyze the log file yourself or post it here and I can take a look at the log file to potentially tell you more about where the phooey reference is coming from.

Regards,

Dave

Re: RPC: Unkown host

D Block 2 — Mon, 13 Sep 2004 21:53:51 GMT

Dave,

thx for the reply...

I've included the requested files..
nsswitch.conf & mnttab (see below).

I also run (before), a while ago:
/usr/lib/netsvc/fs/autofs/automountd -T
[[ not sure, if this is like sending a SIGUSR2 kill to the automountd process ]]

but, thx, I'll try the SIGUSR2 to automountD.

cat /etc/nsswitch.conf
hosts: files [NOTFOUND=continue UNAVAIL=continue TRYAGAIN=continue] dns [NOTFOUND=return UNAVAIL=continue TRYAGAIN=return]

sendmailvars: files [NOTFOUND=continue UNAVAIL=continue TRYAGAIN=continue] dns [NOTFOUND=return UNAVAIL=continue TRYAGAIN=return]

cat -v /etc/mnttab
/dev/vx/dsk/rootdg/rootvol / vxfs log 0 1 1094951990
/dev/vx/dsk/rootdg/standvol /stand hfs defaults 0 0 1094951992
/dev/work/work /work vxfs delaylog,largefiles 0 0 1094952003
/dev/csgbill/csgbill /work/csgbillimages vxfs delaylog,largefiles 0 0 1094952003
/dev/vx/dsk/rootdg/varvol /var vxfs delaylog 0 0 1094952004
/dev/vx/dsk/rootdg/crashvol /var/adm/crash vxfs delaylog 0 0 1094952005
/dev/vx/dsk/rootdg/usrvol /usr vxfs delaylog 0 0 1094952005
/dev/veritas/veritas /usr/openv vxfs delaylog,largefiles 0 0 1094952005
/dev/vx/dsk/rootdg/tmpvol /tmp vxfs delaylog 0 0 1094952006
/dev/vx/dsk/rootdg/syslog /syslog vxfs delaylog 0 0 1094952006
/dev/orahome/orahome /oracle vxfs delaylog,largefiles 0 0 1094952006
/dev/vx/dsk/rootdg/optvol /opt vxfs delaylog 0 0 1094952007
/dev/data/data /data vxfs delaylog,largefiles 0 0 1094952007
/dev/apps/apps /apps vxfs delaylog,largefiles 0 0 1094952007
-hosts /net autofs ignore,indirect,nosuid,soft,rsize=32768,wsize=32768 0 0 1094952065
nas02server:/webbills04 /webbills/04 nfs rsize=32768,wsize=32768,NFSv3 0 0 1094952066
nas02server:/prodbill/03 /webbills/03 nfs rsize=32768,wsize=32768,NFSv3 0 0 1094952066
nas02server:/devbill /devwebbills nfs rsize=32768,wsize=32768,NFSv3 0 0 1094952066

Re: RPC: Unkown host

Dave Olker — Mon, 13 Sep 2004 21:58:52 GMT

Hi Tom,

Ok, it looks like /net -hosts is really the only AutoFS mount point on your system. Let's see if the debug trace picks up anything else useful.

By the way, doing the SIGUSR2 is different than starting automountd with a -T. The SIGUSR2 logging is much more verbose than -T logging.

Let me know if you get a debug automountd log file that captures an instance of the "phooey" error message.

Regards,

Dave

Re: RPC: Unkown host

D Block 2 — Mon, 13 Sep 2004 22:08:58 GMT

4 grins & giggles.. I did the -17 kill to automountd, then followed w/ a: ls /net/phooey and noticed this in the syslog.log(file): could it be, that there is a listener process, see below called popper??

Sep 13 23:07:06 automountd[1094]: phooey : RPC: Unknown host

<< this I have seen before as above: tom >>
<< note: arrow brackets used for substitution >>

Sep 13 23:07:16 popper[14998]: (v2.3) Unable to get canonical name of client, err = 239
Sep 13 23:07:16 v1 popper[14998]: Stats:
0 0 0 0

Re: RPC: Unkown host

Dave Olker — Mon, 13 Sep 2004 22:21:37 GMT

Hi Tom,

Um, actually I was expecting you to turn on debug logging via "kill -17" and then sit back and wait for some other process to cause a syslog entry to happen, not for you to do an "ls /net/phooey". I already *know* that will cause an entry to happen. :)

The popper program is as good a candidate as any other for causing this problem. Is there some popper configuration file that has a reference to "phooey" or "/net/phooey" in it?

However, an errno of 239 indicates an ECONNREFUSED, which typically means that an application is trying to connect to a service on a working system and getting denied. I would expect that whatever application is causing this error would log an RPC_UNKNOWNHOST error or some similar type of error indicating the hostname could not be resolved.

If you enable debug AutoFS logging and then wait for the offending application to cause a "phooey" syslog entry to happen then the debug log file will hopefully be more meaningful than generating the message yourself.

Regards,

Dave

Re: RPC: Unkown host

D Block 2 — Mon, 13 Sep 2004 22:36:26 GMT

Dave,

I'm in monitor mode for awhile... will keep you posted if I catch something in this log file...

really appreicate your help here...

thx so much,

Tom

Re: RPC: Unkown host

Dave Olker — Mon, 13 Sep 2004 23:10:41 GMT

Tom,

Happy to help. One other thing to do - as soon as you see an entry in the syslog.log file for "phooey", collect a "ps -ef" output to a file so that you'll have some idea what processes were running when the log entry was made.

Of course, if the offending process is a short-lived one, or one that exits because it can't find "phooey" then the ps output might not catch it, but it's worth collecting anyway.

Regards,

Dave

Re: RPC: Unkown host

D Block 2 — Tue, 14 Sep 2004 09:52:34 GMT

great news, I have a lead on debugging phooey messages, but haven't been able to run: ps -ef. H'mm, I also now realize that the 'automount' is threaded. That is, the automount.log(file) shows threadIDs.

here's the automount.log results:
Sep 14 09:13:35 (thread 32) LOOKUP REQUEST : name=phooey map=-hosts opts=no
suid,soft,rsize=32768,wsize=32768 path=/net
Sep 14 09:14:31 (thread 32) LOOKUP REPLY : status=2
Sep 14 09:15:11 (thread 1) LOOKUP REQUEST : name=phooey map=-hosts opts=no
suid,soft,rsize=32768,wsize=32768 path=/net
Sep 14 09:16:08 (thread 1) LOOKUP REPLY : status=2
Sep 14 09:16:08 (thread 33) LOOKUP REQUEST : name=phooey map=-hosts opts=no
suid,soft,rsize=32768,wsize=32768 path=/net
Sep 14 09:17:05 (thread 33) LOOKUP REPLY : status=2

Re: RPC: Unkown host

Dave Olker — Tue, 14 Sep 2004 23:06:40 GMT

Hi Tom,

Yes, our AutoFS daemon is multi-threaded. I don't see anything in the debug output that gives me any indication where these "phooey" references are coming from. All they confirm is that the map entry being hit is "/net", which we pretty much already knew from looking at your maps and /etc/mnttab contents.

The only other information this debug logfile provides is the timestamps of when the offending application caused a lookup of "phooey", which you may be able to use to reconcile against the "ps -ef" output to help determine where these "phooey" references are coming from.

When you say you have a lead on debugging the phooey messages, do you mean you think you know which application is referencing the /net/phooey directory?

Regards,

Dave