PIPE files

[Wim Van den Wyngaert]

On many but not all of my nodes I find the file sys$manager:pipe_'node'.com. This on 6.2 and 7.3. Creation rate between 1 and 10 over 4 years.

In it is "ucx show interface". On the system with SSH installed I find in it "multinet show/config" (not on all systems with multinet installed !).

Who/what is creating this file ? I did a search for pipe_ in *.com and *tcp*.exe without success.

Wim

[Karl Rohwedder]

Wim,

perhaps from one of the pipe-emulation procedures/programs, that floated around before the PIPE function was implemented in VMS.

regards Kalle

[Hein van den Heuvel]

Yeah, quite possibly a helper file.

What is in the file?
Readable/Recognizable?
Start with $dump/recor=count=3

I guess the owner is 'system' and will not help much.

Groetjes,
Hein.

[Wim Van den Wyngaert]

Kalel,

Don't use such stuff over here.

I found that the file is sometimes created while I'm not here (at night).

Wim

[Wim Van den Wyngaert]

Kalle,

Don't use such stuff over here.

I found that the file is sometimes created while I'm not here (at night).

Wim

[Wim Van den Wyngaert]

Hein,

As said : it contains "ucx show interface".

It is present on all kind of machines : stations (low %) and servers (high %).

Wim

[Wim Van den Wyngaert]

Hein : owner is system.

[EdgarZamora]

I suspect a home-grown procedure is writing that file. Try searching your system disk (and whatever other disks you may be storing system admin command procedures in)for "pipe_" or maybe even "pipe_''node'".

Good luck.

[Jan van den Ende]

Wim,

since that file appears in the System Manager home directory, I would begin to feel a little suspicious.
Do you know EVERYBODY that is supposed to be allowed to work there / under the SYSTEM account?
It would have to be someone with SYSPRV (or groupUIC < %O10 ?? brrr ).

Are you sure there is NO way those systems can be probed?

Have you got a recent suspect file, and accounting info for when this file was created?

It may be the famous needle in the haystack, but if I correctly understand your environment, finding that needle DOES warrant some expense. And in the (likely) event that it is innocent after all, you at least will have proven that nothing goes unnoticed....

Happy hunting.

Proost.

Have one on me.

jpe

[Wim Van den Wyngaert]

I did a search for "show interface" and "pipe" on all files on the system disk. Nothing.

Started verifying accounting (just before Jan suggested it) and found processes coming from another system. Then I remembered doing something yesterday around the time of the last file.

I have WASD running under the SYSTEM account. I started a CGI script that in turn did a t2t to another node (the one with the pipe_ file). This node executes commands given by the other node (via t2t) and returns the output. To return the output, it directs the output to a temp file (not the pipe_ one).

The command to execute was a script located on yet another node. It generates html system info. And here it used a file pipe_node.com. And didn't clean it up.

Because a multinet command was used, I thought it couldn't be our error. But this code came from the internet ...

Solved. Thx for thinking with me.

Wim