List of proccess

[Alexander Ketshvili]

Hello can anybody explain what this proccesses are on HP_UX v 31:

root 25 0 0 Jan 13 ? 0:00 usbmsd
root 34 0 0 Jan 13 ? 0:00 nfs4_async_io
root 43 0 0 Jan 13 ? 0:00 lvmp_schedd
root 42 0 0 Jan 13 ? 0:00 lvmp_kd
  root 36 0 0 Jan 13 ? 0:00 cachefskd
root 35 0 0 Jan 13 ? 0:00 autofskd
root 44 0 0 Jan 13 ? 0:00 lvmp_wk_th_d
root 53 0 0 Jan 13 ? 0:00 lvmattachd
root 52 0 0 Jan 13 ? 0:00 lvmdevd
root 51 0 0 Jan 13 ? 0:00 mdep_initiator_thread
root 50 0 0 Jan 13 ? 0:00 strfreebd
root 49 0 0 Jan 13 ? 0:00 strweld
root 48 0 0 Jan 13 ? 0:00 strmem
root 47 0 0 Jan 13 ? 0:00 smpsched
root 46 0 0 Jan 13 ? 0:00 inet_areset_daemon
root 45 0 0 Jan 13 ? 0:00 afinet_strout
root 54 0 0 Jan 13 ? 0:00 swapdaemon
root 60 0 0 Jan 13 ? 0:00 dcda_daemon
root 59 0 0 Jan 13 ? 0:05 progressdaemon
root 58 0 0 Jan 13 ? 0:00 awd
root 4 0 0 Jan 13 ? 0:09 unhashdaemon
root 3 0 0 Jan 13 ? 0:19 statdaemon 

I need the justification for PCI-DSS..  

[Duncan Edmonstone]

Alexander,

I think we've looked at some of these before:

http://h30499.www3.hp.com/t5/System-Administration/HP-UX-services-defenition/m-p/5405405#M476883

Is it not sufficient to say, that as they all have PPID of 0, they are all kernel daemons (i.e. part of the OS kernel), and you therefore have no choice over running them? There's ceratinly no place you can disable these daemons from. They start when the OS kernel starts.

[Dennis Handly]

>can anybody explain what this processes are on HP-UX  11.31:

Have you checked to see if any have man pages?

[Alexander Ketshvili]

Hi Duncan

The previouse explanation was realy good. I need the same explanation for that proccesses too.

Unfortunatly for audit it's not enough to tell that this proccesses are the part of OS kernel. I have to know what are they needed for. Is there any documantaion or can you make some short explanation? 

Thank you in advance

Alexander Ketishvili 

[Duncan Edmonstone · Accepted solution]

Alexander,

I get pretty frustrated by this approach to auditing - can you imagine them auditing a car? "What are those 4 wheels for? Do you really need that steering wheel? Please justify why the car needs fuel?"

There's no documentation as these processes are supposed to be of no consequence/interest to the user - in the words of the wizard of Oz "Pay no attention to that man behind the curtain" . Still, here's what I know/can surmise:

usbmsd - covered this one already - part of the USB subsystem - if you have USB devices on your system, you need the USB driver, so need this. If not, you could try unloading the USB modules from the kernel using kvmodule or kcweb (beware! many DVD drives are USB based on HP-UX systems now, so double check!)

nfs4_async_io - manages NFS kernel asynchronous IO - if you don't use NFS, try setting all relevant paramters to 0 in /etc/rc.config.d/nfsconf, reboot and see if it is still running - failing that you could look at unloading the nfs* modules in the kernel

cachefskd, autofskd - in both cases also part of the NFS subsystem - kernel daemons for cache filesystems and the automounter. Again if you think you don't use these, there are kernel modules (autofs and cachefs) that could potentially be unloaded to stop them running.

lvmp_schedd, lvmp_kd, lvmp_wk_th_d, lvmattachd, lvmdevd - All part of the LVM subsystem - do not touch unless you want to break LVM

mdep_initiator_thread - not sure, but mdep is usually shorthand for "machdep" or "machine dependent code" - at a guess this is part of the kernel interface to the underlying system firmware

smpsched strfreebd, strweld, strmem - part of the network stack - streams daemons - I suspect this is another "do not touch" component.

afinet_strout, inet_areset_daemon - no idea - networking related?

swapdaemon - no idea - presumably related to management of swap

progressdaemon - this one is a little complex - A CPU-bound POSIX realtime thread can completely starve other threads bound to the processor it's running on since the load balancer is not permitted to move them away. progressdaemon periodically scans for this form of cpu distress and, when detected, tries to move the offending thread to another processor. I'd just think of it as part of the scheduler

statdaemon - is also part of the scheduler - it initiates the process or re-assesing and adjusting thread priorities once every second

unhashdaemon - do you know what the pdir is in a kernel? - its part of the kernel virtual memory subsystem and is responsible for address translation between virtual and physical pages (it's basically a table listing virtual page numbers and corresponding physical page numbers) - the unhashdaemon is responsible for monitoring the number of pdir entries that are avilable, and allocating more if required.

awd, dcda_daemon - no idea - complete mystery!

Good luck getting any more detail than that - As I said, these processes are part of the kernel, you can't touch them or interfere with them in any way, so you may as well say "why do I need to run an OS?" It's the same slightly daft question.

[Alexander Ketshvili]

Thanks a lot for the help.

Partially i agree with you about the nonsense of a such detail audit, but in any case to know what this proccesses are it's not bad idia. I will try to explain once again to audit that this is the part of the kernel. Thanks once again