mk_kernel

[Dennis Handly]

>I also did not see any exceptions.

Then you need to ask management for one.

[Dennis Handly]

While you are waiting for management approval to use tusc, you can make a copy of kmckintfc and add -x to enable to trace the flow:

In/usr/sbin/:
mv kmckintfc kmckintfc.orig
cp kmckintfc.orig kmckintfc

Change the first line to:
#!/sbin/sh -x

This script is using awk all over, so awk better be the official version and not one in /usr/local/bin/.

[behnam_2]

> While you are waiting for management approval to use tusc, you can make a copy of kmckintfc and add -x to enable to trace the flow:


Dennis, the fine is an executable and not an script.

[Patrick Wallek]

>>the fine is an executable and not an script.


From one of my HP-UX 11.11 systems:

# cd /usr/sbin/
# ll kmckintfc
-r-xr-xr-x 1 bin bin 6033 Nov 14 2000 kmckintfc*
# file kmckintfc
kmckintfc: ascii text


Yes, the file has the execute bit set, but it is still just a script. If your file is any different, then it is non-standard.

[behnam_2]

That is interesting Patrick. What I have is completely diffrent. Even the ownership of the file is not the same.

# ll kmckintfc
-r-sr-xr-x 1 lp bin 40960 Jul 15 2006 kmckintfc
# file kmckintfc
kmckintfc: PA-RISC1.1 shared executable dynamically linked
# which kmckintfc
/usr/sbin/kmckintfc
#
# uname -a
HP-UX ottud050 B.11.11 U 9000/785 2006389503 unlimited-user license
#

[Patrick Wallek]

I just check **ALL** of my HP-UX 11.11 servers and they all show the exact same information for the kmckintfc file as I posted above.

I am looking on my other HP-UX servers and I don't find a file that even closely resembles yours.

[Patrick Wallek]

Run this command and post the output back, please:

# what /usr/sbin/kmckintfc

That should tell us exactly what this file is and may indicate what happened.

[behnam_2]

# what /usr/sbin/kmckintfc
/usr/sbin/kmckintfc:
cancel.c $Date: 2006/06/10 04:26:48 $Revision: r11.11/2 PATCH_11.11 (PHCO_34993)
fifo.c $Date: 2004/02/10 10:18:31 $Revision: r11.11/1 PATCH_11.11 (PHCO_30431)
outputq.c $Date: 2006/06/10 04:26:44 $Revision: r11.11/1 PATCH_11.11 (PHCO_34993)
pstatus.c $Date: 2006/05/09 05:24:03 $Revision: r11.11/1 PATCH_11.11 (PHCO_34822)
request.c $Date: 2002/07/24 07:56:42 $Revision: r11.11/2 PATCH_11.11 (PHCO_27020)
sendmail.c $Date: 2002/12/09 22:14:26 $Revision: r11.11/2 PATCH_11.11 (PHCO_28256)
common.c $Date: 2005/06/29 21:38:29 $Revision: r11.11/3 PATCH_11.11 (PHCO_33401)
mpstatus.c $Date: 2004/03/11 19:51:46 $Revision: r11.11/1 PATCH_11.11 (PHCO_30431)
$Revision: @(#) lp R11.11_BL2006_0715_2 PATCH_11.11 PHCO_34993
#

[Patrick Wallek]

>>cancel.c $Date: 2006/06/10 04:26:48 $Revision: r11.11/2 PATCH_11.11 (PHCO_34993)

There's the explanation!!!

Someone accidentally copied /usr/bin/cancel to /usr/sbin/kmckintfc.

If you look at the /usr/bin/cancel you will probably see that it has the exact same characteristics as your bad kmckintfc file.

Check your backups and see if you have the correct /usr/sbin/kmckintfc file that you can restore.

If not, do you have another HP-UX 11.11 system that you can copy this file from?

[Dennis Handly]

>Patrick: Someone accidentally copied /usr/bin/cancel to /usr/sbin/kmckintfc.

Ah, and since cancel is a hardlink, that's probably why it prints "/usr/sbin/kmckintf:" rather than "cancel:".

You may want to use "swverify \*" to see how many other files are messed up.