System Administration
cancel
Showing results for 
Search instead for 
Did you mean: 

failed sys calls in audit log

Michael Ernstoff
Frequent Advisor

failed sys calls in audit log

I switched C2 audit logging on a server recently (normally left off due to space considerations).
I was surprised to see that in one hour there were 3 million failed "close" system calls, and only half a million successful "close" system calls.
All failed "close" calls were because "fildes is not a valid open file descriptor".
Is this typical? or does it indicate a problem?
How do I dig deeper?
I am running HP-UX 11i version 1.
Application is using Oracle 10.20 and most of the failed system calls were oracle or the application ID.
6 REPLIES
Steven E. Protter
Exalted Contributor

Re: failed sys calls in audit log

Shalom,

An application is badly managing its open/close system calls.

Most likely its not serious but I would look to http://metalink.oracle.com to find a bug fix for the applications.

SEP
Steven E Protter
Owner of ISN Corporation
http://isnamerica.com
http://hpuxconsulting.com
Sponsor: http://hpux.ws
Twitter: http://twitter.com/hpuxlinux
Founder http://newdatacloud.com
Michael Ernstoff
Frequent Advisor

Re: failed sys calls in audit log

Sounds reasonable, but what does "application is badly managing" actually mean?
Dennis Handly
Acclaimed Contributor

Re: failed sys calls in audit log

>but what does "application is badly managing" actually mean?

It means a well written application only closes files that it opened successfully.

Though I've seen (using tusc) the shell try to close a whole bunch of files in sequential order.
Dennis Handly
Acclaimed Contributor

Re: failed sys calls in audit log

Something like this for ksh:
close(2046) .. ERR#9 EBADF
close(2045) .. ERR#9 EBADF
close(2044) .. ERR#9 EBADF
close(2043) .. ERR#9 EBADF
close(2042) .. ERR#9 EBADF
close(2048) .. ERR#9 EBADF
close(2047) .. ERR#9 EBADF
Michael Ernstoff
Frequent Advisor

Re: failed sys calls in audit log

So is this unusual? typical?
Anyone see similar results for Oracle systems?
Dennis Handly
Acclaimed Contributor

Re: failed sys calls in audit log

>So is this unusual? typical?

This is typical for ksh and probably sh. (It is freeing a parking space for the FDs 0-9?) But I wouldn't think an application would do this.