Printing issue in HP-UX

[Shibin_2]

I have an HP-UX Superdome server running with HP-UX 11iv2. One partition, which is primary SAP host, having printing issue. Whenever, user complaint can't print from SAP, we found the permission of outputq changed to sapsys ( see below, with old one for record ).

root@hpv01:(root)> ll /var/spool/lp/*q
-rw-r----- 1 lp sapsys 470404 Nov 27 19:30 /var/spool/lp/origoutputq
-rw-r----- 1 lp lp 56772 Jan 3 13:30 /var/spool/lp/outputq


We raised few cases with HPRC, but they too helpless as there is no logs available, who, what and how it changed.

Any help, appreciated. This is production server.

[Kapil Jha]

the very first thing which come to me is to see if there is any setgid?

BR,
Kapil+

[Shibin_2]

There is no setgid. All permission levels are correct.

[Hakki Aydin Ucar]

seems not easy way to track how this change occured.
I recommend you to try HIDS (=Host intrusion detection systems) It might be useful to keep track of why this files' group changed.

[Shibin_2]

Is there any other option, other than HIDS ? I am afraid to install this, because it is customer's primary production server.

[Hakki Aydin Ucar]

Did you check the history files to find at least, anyone did it manually ?

[Shibin_2]

There is nothing in the history file. I have checked this as well.

[Dennis Handly]

You could turn on auditing.
But that seems expensive for something that happened back in Nov.

[Alzhy]

/var/spool/lp/outputq should be lp:sys owned and should have 644 (rw-r--r-- permissions).

Try changing perms to that to address our printing issues instead of trying to uncover the culprit (although it is possible a humn effected that change)

[Dennis Handly]

>Alzhy: /var/spool/lp/outputq should be lp:sys owned and should have 644 (rw-r--r-- permissions).

Hmm. On one of my systems it has my GID there and the same permissions as Shibin's.

>although it is possible a human effected that change

Most likely. ;-)
Though in my case, all I could have done is print a file.