Audit_server process missing every Friday at system time 22hrs

[Kumaresan Giri]

Audit_server process missing every Friday at system time 22hrs

Every Friday between the system time 22:00 hrs to 23:00 hrs AUDIT_SERVER missing process in SYSTEM this process running under the user name AUDIT$SERVER.I checked the all scheduler and batch jobs but none of the job are stopping the Audit process.
System running the VAX/VMS V5.5-2.

$ show process/id=20200B14/accou

9-MAR-2008 05:48:39.55 User: AUDIT$SERVER Process ID: 20200B14
Node: AYOV27 Process name: "AUDIT_SERVER"

Accounting information:
Buffered I/O count: 465 Peak working set size: 494
Direct I/O count: 130 Peak virtual size: 3880
Page faults: 1423 Mounted volumes: 0
Images activated: 0
Elapsed CPU time: 0 00:00:01.15
Connect time: 6 05:09:20.74

$ Account/user= AUDIT$SERVER

Date / Time Type Subtype Username ID Source Status
--------------------------------------------------------------------------------
22-FEB-2008 22:04:17 PROCESS DETACHED AUDIT$SERVER 2020020D 1000043C

DETACHED Process Termination
----------------------------

Username: AUDIT$SERVER UIC: [V7K,SYSTEM]
Account: Finish time: 22-FEB-2008 22:04:17.79
Process ID: 2020020D Start time: 17-FEB-2008 18:26:32.61
Owner ID: Elapsed time: 5 03:37:45.18
Terminal name: Processor time: 0 00:00:03.76
Remote node addr: Priority: 8
Remote node name: Privilege <31-00>: 501DF021
Remote ID: Privilege <63-32>: 00000000
Queue entry: Final status code: 1000043C
Queue name:
Job name:
Final status text: %SYSTEM-F-OPCDEC, opcode reserved to DIGITAL fault at PC=!XL

Page faults: 18701 Direct IO: 120
Page fault reads: 53 Buffered IO: 419
Peak working set: 700 Volumes mounted: 0
Peak page file: 22497 Images executed: 1
$ write sys$output f$message(%x1000043C)
%SYSTEM-F-OPCDEC, opcode reserved to DIGITAL fault at PC=!XL, PSL=!XL

$ mc authorize show AUDIT$SERVER
%UAF-W-BADSPC, no user matched specification

Can any one help me to solve this issue.

Regards,
Kumaresan.V

[Volker Halle]

Kumaresan.V,

looks like the AUDIT_SERVER image terminated with an internal software error. An OPCDEC fault could be caused trying to execute a HALT instruction in USER mode, e.g. when the PC points into a data area.

Look for a process dump (AUDIT_SERVER.DMP) in SYS$MANAGER or SYS$SYSTEM.

Ther may be some related error in OPERATOR.LOG. Also check the audit logfile for any audit record seen immediately preceeding the process termination.

Volker.

[Volker Halle]

Kumaresan.V,

a problem with thses symptoms is not mentioned in any OpenVMS VAX V5.5-2 patch kit, so it may not be a generic problem.

Since when does this problem happen at your system ?

Which version of AUDIT_SERVER.EXE are you running ? Use $ ANAL/IMAGE/INT SYS$SYSTEM:AUDIT_SERVER.EXE and provide the data from the image identification area.

Volker.

[Hoff]

Which VAX or which VAX emulation here?

Patched to current? If not, start there.

What else happens in that window? Resetting or reinstalling stuff? (As part of this, I'd probably turn on Use Of Privileges auditing around 21:00 and watch the show up through the failure.)

Any particular errors or audits found that are leading up to the OPCDEC? Is there a consistent prologue to this error?

The PID implies a cluster. Are there other relevant and contemporaneous activities occurring elsewhere within the cluster?

The text UIC is very odd. [V7K,SYSTEM]? That's very wrong for a typical configuration. Which also leads to a question around exactly how the audit server is being launched, too. During startup? Or manually? Are the twenty-or-so critical files in the cluster all being coordinated across all of the cluster member nodes, including (specifically for this case) VMS$OBJECTS.DAT?

And do contact HP support.

[Jon Pinkley]

RE:"The text UIC is very odd. [V7K,SYSTEM]?"

While not the default, it is easy to reproduce this without any side effects other than the possibility of a command procedure testing the ASCII text.

Here's a demo.

OT$ uaf s /id v7k
%UAF-E-SHOWERR, unable to complete SHOW command
-SYSTEM-F-NOSUCHID, unknown rights identifier
OT$ dir/sec sys$system:show.exe;

Directory SYS$COMMON:[SYSEXE]

SHOW.EXE;1 [SYSTEM] (RWED,RWED,RE,RE)

Total of 1 file.
OT$ uaf add/id v7k /val=uic:[1,*]
%UAF-I-RDBADDMSGU, identifier V7K value [000001,177777] added to rights database
OT$ dir/sec sys$system:show.exe;

Directory SYS$COMMON:[SYSEXE]

SHOW.EXE;1 [V7K,SYSTEM] (RWED,RWED,RE,RE)

Total of 1 file.
OT$ uaf rem/id v7k
%UAF-I-RDBREMMSGU, identifier V7K value [000001,177777] removed from rights database
OT$ dir/sec sys$system:show.exe;

Directory SYS$COMMON:[SYSEXE]

SHOW.EXE;1 [SYSTEM] (RWED,RWED,RE,RE)

Total of 1 file.
OT$