about rpcd daemon!

[leyearn]

when my system is running!
the rpcd daemon is terminated abruptly!
now these are the files :
/var/opt/dce/svc/error.log
the content:

2003-09-04-04:59:01.068+00:00I----- dced ERROR dhd general main.c 1263 0x7afbbd80 Process (pid 1540) exited with status 0400!

/var/opt/dce/svc/fatal.log
the content :
2003-09-04-04:59:00.799+00:00I----- dced FATAL dhd general main.c 667 0x7afbbd80 Cannot use '*all*' protocol sequence, Permission denied
2003-09-08-12:46:33.004+00:00I----- dced FATAL dhd general main.c 720 0x7afbbd80 Initialization (global data) failed, status=0x0000ff03.
2003-09-08-12:48:59.474+00:00I----- dced FATAL dhd general main.c 720 0x7afbbd80 Initialization (global data) failed, status=0x0000ff03.

[leyearn]

whan can i do to solve this problem?

[Tim Adamson_1]

Perhaps you could run a swverify to ensure there is no corruption in the DCE related filesets.

# swverify \* <<< This will check your whole system and could take a little while to run.



Tim.

[Con O'Kelly]

Hi

Has anything changed on the system since you've encountered this problem? For example have you installed new applications or patches or have you always had issues with rpcd?

Can you also advise what you are using DCE for - OVO(ITO), Measureware?

You could check DCE Patches or if possible re-install the DCE software form the application CD's.

Cheers
Con

[leyearn]

my system is hp9000 c100 workstation
the os is hpux10.10
i using the vue!

[Bill Hassell]

HP-UX version 10.10 has been obsolete for many years so about all you can do is to obtain any DCE patches that exist for 10.10 and see if that fixes the problem. DCE is also critically dependent on a working network so networking patches may also be needed. You can obtain all the 10.10 patches from http://www1.itrc.hp.com/service/patch/search.do?pageContextName=hpux:::

A quick search of DCE at that site shows 40 patches that may be needed althught the vast majority are for specific products rather than DCE alone.

[Con O'Kelly]

Hi

I don't know much about VUE. Are you having problems with VUE as a result of rpcd not running? From a quick look it appears that the Audio Server needs rpcd but apart from that I don't know if VUE requires DCE.

All I could suggest is ensuring you have the "latest" patches for VUE & DCE for 10.10.

As I said before, the other thing to look at is when did this issue start? Was there any changes to the system etc or have you always had the problem?

Cheers
Con

[Glen Trevino]

Possibility...

We recently had a problem with DCE on a 10.20 box that was caused by the MS-Blaster worm. It seems that there was a patch put out back in 1999 for an "oversensitive" DCE daemon that was never applied to this box. The broadcasting that this worm did can cause DCE to crash. There was a SANS alert about this that called it a possible Denial of Service. Took us most of the day to figure this out, well actually we were tipped off by a HP Software Engineer from support...

I'd try to get this patch and also check your subnet for 2000 and XP machines that may be infected with this worm.

Here is HP's Official Response but it is not just OpenView, it's anything running DCE:

HP OpenView Products Impacted by ???Blaster??? Worm Virus
August 20, 2003

HP OpenView has determined that the worm virus recently referred to as ???Blaster??? or ???W32.Blaster.worm???, may impact OpenView products running on Microsoft Windows, HPUX, Solaris and Linux.

More information about the worm can be found at: <>

It is important that you follow the instructions from Microsoft and apply appropriate patches to all servers running Microsoft Windows.

If the worm enters your network, it could affect other operating systems that use RPC communications.

For HP-UX B.11.11 systems, no extra patching is required. For earlier HP-UX versions, we recommend that you patch the DCE to at least the following levels:

B.11.00 - PHSS_17810 or subsequent patch
B.10.20 - PHSS_19739

For Solaris systems (all versions), there is a fix available that will replace the HPlwdce binaries. This fix applies to any OV product or product version that uses the HPlwdce. To receive the fix, contact your support representative. A patch will soon be available, and you will be notified when it is available and can be downloaded.

For Linux systems, a fix has just been developed and is being tested. If you would like to obtain the fix, contact your support representative.

For other operating systems, we recommend you contact the vendor to see if further patches are appropriate.

If you encounter this virus and have problems with your HP OpenView application, please open a support case with HP OpenView support <>.

Please continue to monitor the HP OpenView support website <> for additional updates.

[Alan Turner]

Further to Glen's post (but no help to the originator, on 10.10) -

11.11 can be vulnerable (depending on patches) - if you have PHNE_28895 (to overcome Security Bulletin 264) then you're vulnerable to Security Bulletin 276, and need PHSS_28386 plus downloads of libcma.1 and libcma.2 (SB276 Rev 01).

[leyearn]

but my system is hp9000 c100 workstation
the os is hpux10.10
which patch can i use?
thanks