Kernel Logging on HPUX 11i V1

[chris huys_4]

Hi,

> I agree with the maxuprc and currently have
> a change request going through to double it.
> It would just be nice to see this limit in a
> log so i can say "This is the problem"
> rather than a "i think it might be this..."

Shouldnt be to difficult to verify. Just put a ps -ef/lsof, checking every process, in cron, to be run, every f.e. 15 minutes.

When the application then "dies", check how many threads were forked, just before it died, and see if its near the amount of the maxuprc or any other related kernel parameter.

If the app dies a few times and the numbers are "near" and after the maxuprc has increased the "numbers" increase over this "number", you can be pretty sure that you found the problem.

Also Im not sure what you mean with "on doing the extract", but the application would surely leave a corefile, when it dies and so should give at least a reason, file core, why it died ?

Greetz,
Chris

[Mark_99_1]

The problem is capturing the problem and if there is anything that leads upto that problem or if it just happens.
From glance the tables are not near their limit but as the tables relate to the whole system, it dones't mean a user has reached a limit.
I was looking at running something like ps -ef|grep user|wc -l every minute.

Unfortunately, lsof is not something that comes standard with HPUX so i am not allowed to install it. This, to me, is one of the most useful commands ever invented - ranks alongside Dtrace.

extract = glance command.
The app doesn't leave a core file :-(

[Dennis Handly]

>the error message it produces is so vague it's uselesss.

Perhaps include it here?

>The app doesn't leave a core file

Any chance of modifying the application to log more info? Is it C or aC++?
Or call abort(3) to get a corefile? Or call U_STACK_TRACE to get a stack trace?

[Dennis Handly]

>lsof is not something that comes standard with HP-UX so I am not allowed to install it.

tusc is also a good tool to monitor system calls and find the last ones that fail.

Which is more important to your management, finding the solution to your problem or your security policies?

[Dennis Handly]

It looks like you need what Tru64 logs: :-)
http://forums.itrc.hp.com/service/forums/questionanswer.do?threadId=1438010

[chris huys_4]

> Unfortunately, lsof is not something that
> comes standard with HPUX

> The app doesn't leave a core file :-(

Then your management shouldnt have allowed a app that leaves no core file to be installed on a production system. ;)

Greetz,
Chris

[Mark_99_1]

Thanks for all your replies.
I agree with what you say about management. They want it fixed but won't give me the tools to do it!

[Mark_99_1]

Haven't been able to find the solution yet but see the only forward is to up the maxuprc limit and get debugging enabled on the application.