HSM - getting error status in security audit when deleting file

[Lokesh_2]

Hi,

On my system, HSM v2.2 is running. When I delete any file, which is shelved, the file got deleted but in the security audit/alarm event I receive following status:

%SYSTEM-F-SHELVED, file contents shelved

I just wonder whether it is normal or not !!

Thanks,
Lokesh

P.S. Below is the security report received when deleting file:

____________________________________________




%%%%%%%%%%% OPCOM 22-OCT-2003 10:12:53.54 %%%%%%%%%%%
Message from user AUDIT$SERVER on NLCALL
Security alarm (SECURITY) and security audit (SECURITY) on NLCALL, system id: 45
524
Auditable event: Object deletion
Event information: file deletion request (IO$_DELETE)
Event time: 22-OCT-2003 10:12:53.53
PID: 20207426
Process name: BATCH_181
Username: GOALS_SUP
Process owner: [GOALS_SUP]
Image name: DSA11:[SYS3.SYSCOMMON.][SYSEXE]DELETE.EXE
Object class name: FILE
Object owner: [GOALS_PROXY]
Object protection: SYSTEM:RWED, OWNER:RWE, GROUP:RE, WORLD:
File name: _DSA14:[GOALS_ROOT.091991]26SEP1991100405_910926040916
.DAT-DCX;1
File ID: (34588,2,0)
Access requested: DELETE
Privileges used: SYSPRV
Sequence key: 0C9A2686
Status: %SYSTEM-F-SHELVED, file contents shelved

_______________________________________________

[Åge Rønning]

Help/mess %system-f-shelved says: Your process tried to access a shelved file, and automatic unshelving is turned off.

Do you get the same message even if you do a SET PROCESS/AUTO_UNSHELVE first?

[Lokesh_2]

Hi Age,

The AUTO_UNSHELVE is ON for the process. There is no problem as such, because the file is successfully deleted from disk. Only thing that bothers me is that security event shows the Fatal message %SYSTEM-F-SHELVED.

Regards,
Lokesh

[Jeff Chisholm]

There's a shelving bit in the file header. This prevents a shelved file from being deleted, even if HSM is not running. I suspect you've deleted the directory reference, but that the file is still out on the disk. (you didn't get the space back).

ANA/DISK/REPAIR should resolve this, by moving the orphan directory pointer to the [SYSLOST] directory on that volume. Note that the disk will be write locked until the repair operation completes.

[Lokesh_2]

Hi Jeff,

HSM is running fine on my system. Let me give you an example which shows that the file is deleted , but I get status message %SYSTEM-F-SHELVED . Any idea why this status is showing, even though file is deleted successfully. Auto_unshelve is ON for my process. Please find below the simulation of my query:

NLCALL>$creat a.b
This is test file.
Exit
NLCALL>$dir/full a.b

Directory DSA14:[000000]

A.B;1 File ID: (4477,5,0)
Size: 1/9 Owner: [SYSTEM]
Created: 24-OCT-2003 08:21:54.51
Revised: 24-OCT-2003 08:22:01.18 (1)
Expires: 24-OCT-2003 08:22:01.19
Backup:
Effective:
Recording:
File organization: Sequential
Shelved state: Online
File attributes: Allocation: 9, Extend: 0, Global buffer count: 0
No version limit
Record format: Variable length, maximum 0 bytes, longest 18 bytes
Record attributes: Carriage return carriage control
RMS attributes: None
Journaling enabled: None
File protection: System:RWED, Owner:RWED, Group:RE, World:
Access Cntrl List: None

Total of 1 file, 1/9 blocks.
NLCALL>$shelve a.b
NLCALL>$sho sys/proc=*hsm*
OpenVMS V7.1 on node NLCALL 24-OCT-2003 08:24:39.60 Uptime 30 12:03:16
Pid Process Name State Pri I/O CPU Page flts Pages
20200285 HSM$SHELF_PEP HIB 6 490623 0 00:38:33.15 50000 18548
202070E8 HSM$SHELF_HNDLR HIB 5 1976162 0 00:59:34.00 7480 7671
NLCALL>$dir/full a.b

Directory DSA14:[000000]

A.B;1 File ID: (4477,5,0)
Size: 1/0 Owner: [SYSTEM]
Created: 24-OCT-2003 08:21:54.51
Revised: 24-OCT-2003 08:22:01.18 (5)
Expires: 24-OCT-2003 08:22:01.19
Backup:
Effective:
Recording:
File organization: Sequential
Shelved state: Shelved
File attributes: Allocation: 0, Extend: 0, Global buffer count: 0
No version limit
Record format: Variable length, maximum 0 bytes, longest 18 bytes
Record attributes: Carriage return carriage control
RMS attributes: None
Journaling enabled: None
File protection: System:RWED, Owner:RWED, Group:RE, World:
Access Cntrl List: (APPLICATION,SIZE=%D253,FLAGS=%X0E03,ACCESS=%X06F706F7,DATA=
%X00000206,%X00000000,%X00000000,%X00000000,%X00000000,
%X00000000,%X00000000,%X00000000,%X00000000,%X00000000,
%X00000000,%X00000000,%X00000000,%X00000000,%X00000000,
%X00000000,%X00000000,%X00000000,%X00000000,%X00000000,
%X00000000,%X00000000,%X00000000,%X00000000,%X00000000,
%X00000000,%X00000000,%X00000000,%X00000000,%X00000000,
%X00000000,%X00000000,%X00000000,%X00000000,%X00000000,
%X00000000,%X00000000,%X00000000,%X00000000,%X00000000,
%X00000000,%X00000000,%X00000000,%X00000000,%X00000000,
%X00000000,%X00000000,%X00000000,%X00000000,%X00000000,
%X00000000,%X65EA4FC0,%X11D805FB,%X0008819D,%X41D62C2B,
%X00000000,%X00000000,%X00000000,%X00000000,%X117D0000,


Total of 1 file, 1/0 blocks.
NLCALL>$del a.b;
%%%%%%%%%%% OPCOM 24-OCT-2003 08:24:51.93 %%%%%%%%%%%
Message from user AUDIT$SERVER on NLCALL
Security alarm (SECURITY) and security audit (SECURITY) on NLCALL, system id: 45
524
Auditable event: Object deletion
Event information: file deletion request (IO$_DELETE)
Event time: 24-OCT-2003 08:24:51.92
PID: 20206EB9
Process name: _TNA196:
Username: SYSTEM
Process owner: [SYSTEM]
Terminal name: TNA196:
Image name: DSA11:[SYS3.SYSCOMMON.][SYSEXE]DELETE.EXE
Object class name: FILE
Object owner: [SYSTEM]
Object protection: SYSTEM:RWED, OWNER:RWED, GROUP:RE, WORLD:
File name: _DSA14:[000000]A.B;1
File ID: (4477,5,0)
Access requested: DELETE
Sequence key: 0D8D7A20
Status: %SYSTEM-F-SHELVED, file contents shelved

NLCALL>$dir a.b
%DIRECT-W-NOFILES, no files found
NLCALL>$sho proc/shelv

24-OCT-2003 08:29:01.75 User: SYSTEM Process ID: 2020664B
Node: NLCALL Process name: "SYSTEM"

Auto-unshelve: on

[Antoniov.]

Hi,
I read help on this feature and I am not sure what this means.
A shelved file is deleted protect? I think is not because there is the D bit in file mask (for owner, group, world and system).
However this bit may originate an alarm so this explain the message on audit server.
Jeff,
why shelved bit avoid deleteing instead the D bit in mask file?
Mhm .. this question is very interesting!

Bye
Antoniov

[Jeff Chisholm]

I talked this over with someone on the team that supports HSM among other things. Since these cases will likely take awhile to resolve, we need to have each of you log a call with the CSC so we can get you the help you need. Our bean counters are happier when we give them beans to count.