Common audit log failures for libogltls.so and locales.1/C

[Bryan Strait]

Hi,

I'm relatively new to the audit logging features of HP-UX. We have 2 messages that are continuously showing up in the audit logs of which I'm not sure of the source. We're running HP-UX 11.23 (May 2005).

One of the features we have turned on are open/close access failures. Every 30 seconds or so, a process is spawned that attempts to open the following shared library and file. This generates a large amount of log entries as the system runs autonomously, continually filling the logs and making it scrutinizingly tedious finding audit failures of relevance.

/opt/graphics/OpenGL/lib/hpux32/libogltls.so

/usr/lib/nls/loc/hpux32/locales.1/C

The failure for the lib0gltls.so is logged because it is not exist but the problem I'm having is locating which service is turned on that accesses these files. The log provides a process ID however by the time it is logged, the process no longer exists.

Does anyone happen to know what service might be looking to access these files or how I might go about finding it?

Thanks in advance for your help.

Bryan

[Steven E. Protter]

Shalom Bryan,

1) Check the existence of these files. Install their depots that provide them if missing.

2) If present, make sure SHLIB_PATH in the startup or any compile scripts includes their locations.

3) Make sure the libraries and executables are IA-64 binaries.

SEP

[Dennis Handly]

These are bogus files that don't exist.
The first may exist if you have OGL installed and dld.so automatically checks for it for every? stinkin' exec(2).

The latter doesn't exist on any system. Years ago setlocale(3) used to do a stat(2) on the shlib before calling shl_load(3) but somehow they decided why check twice.
(This seems silly since there never was that locale and a strcmp for "C" would be easy.)

So your problem is that you keep starting processes. But if it's every 30 seconds, this is normal.

So you should rethink logging access failures. Or you need to filter out these useless messages.

[Bryan Strait]

Thanks guys. I realize how generic this question may have sounded.

When you say dld.so checks for libogltls.so every exec, is this for *all* exec calls or is it only for exec calls that use the libogltls.so library? (I would assume only for execs that use the libogltls.so) If it's for all execs, that would make sense whey there are so many entries in the audit log.

I was just hoping to prevent the process from running since this system is not doing anything graphics related anyway.

Bryan

[Dennis Handly]

>When you say dld.so checks for libogltls.so every exec, is this for *all* exec calls
>If it's for all execs, that would make sense whey there are so many entries in the audit log.

Yes, every stinkin' one that uses shlibs.
If you update your dld patch to something newer like PHSS_37947, it will go away.

[Dennis Handly]

>I realize how generic this question may have sounded.

Generic how? I said exactly why they occur.