about rpcd!

[leyearn]

which configuration file controls the rpcd AutoStart during the system boot?
on my system:
when the system started ,by using ps -ef|grep rpcd
you can see /opt/dce/bin/rpcd exist on the system
but after hours the daemon will disappear

there are one audio hardware in my hp9000 c1000 workstation (os= hpux 10.10),when the rpcd disappears ,i test my audio device ,it will produce "unable to access the audio hardware "

the /opt/audio/bin/Aserver is running !

after I start the rpcd manually ,i test my audio ,it works well!

[Andi Rigauer]

look for the dced in the startup configuration.
The rpcd links to dced.

hope that helps
Andi

[T G Manikandan]

On 11.0 you have

/etc/rc.config.d/Rpcd

where you mention a auto-start

and this is enabled using the startup script,

/sbin/init.d/Rpcd start

i am not sure you have the structure in 10.10

[Alan Turner]

On HP-UX 11.11, rpcd is started by /sbin/rc2.d/S570dce, symbolically linked to /sbin/init.d/dce

There have been threads in the past few days about DCE dying, it might be worth looking at those.

Also, be aware that some external network traffic, perhaps related to the Blaster worm, can make DCE fail. See Security Bulletin 273 (10.20, 11.00) and 276 (11.11); also see Security Bulletin 264

If you're on 11i, SB276 is reckoned to be fixed by PHSS_28386 plus downloaded updates to libcma.1 and libcma.2 (not yet tried on my systems)

[Alan Turner]

Re-reading your post, I see you're on 10.20.

The fix for SB273 is PHSS_19739. SB264 and 276 don't apply. 10.20 rpcd is started by /sbin/init.d/dce, as the S570 symbolic link in /sbin/rc2.d.

I understand that "dced" and "rpcd" are the same program - it runs as dced if DCE is configured, otherwise it runs as rpcd (ref. a post by Alex Glennie).

[T G Manikandan]

Any messages in

/var/opt/dce/svc/*.log



you should check your /etc/rc.config.d

and /sbin/init.d

for the startup scripts

[John Bolene]

the blaster worm is responsible for this

some Windows machines that can send traffic to your UNIX machine are infected

We have this currently running in our company, seems that a few machines did not have Norton running and the people were using them to check their home email and guess what, they opened the virus/worm messages.

It causes our rpcd on 10.20 to die every once in awhile. We had to put a cron in to check once an hour and restart it. And of course there is no log anywhere.

On 11x it seems to cause the rpcd to go stupid but not quit. These have to be killed and restarted.

HP is madly working on fixes.

I have heard that they will make a patch available for 10.20, but no other 10x or less will have a patch.

[John Bolene]

more info I got in email...........but it is for 11.11



PHNE_27063 introduced new behavior which can cause DCE
libraries to fail. The behavior is present in the
superseding patches PHNE_28089 and PHNE_28895.

The worm referred to as "Blaster" or "W32.Blaster.worm"
creates network traffic which can lead to the DCE failure when
PHNE_27063, PHNE_28089, or PHNE_28895 is installed.

As the worm attempts to find new systems to infect it can
cause programs to fail. HP-UX is impacted as a side effect
of the network traffic generated by the worm.

The change introduced in PHNE_27063 may have a wide impact,
but at this time the failure has been observed in programs
which use libcma, such as /opt/dce/sbin/rpcd and the sd
programs (swinstall, swlist, etc.).

[leyearn]

the error file on my computer /var/opt/dce/svc/error.log

the content:
2003-09-04-04:59:01.068+00:00I----- dced ERROR dhd general main.c 1263 0x7afbbd80 Process (pid 1540) exited with status 0400

/var/opt/dce/svc/fatal.log
the content:

2003-09-04-04:59:00.799+00:00I----- dced FATAL dhd general main.c 667 0x7afbbd80 Cannot use '*all*' protocol sequence, Permission denied
2003-09-08-12:46:33.004+00:00I----- dced FATAL dhd general main.c 720 0x7afbbd80 Initialization (global data) failed, status=0x0000ff03.
2003-09-08-12:48:59.474+00:00I----- dced FATAL dhd general main.c 720 0x7afbbd80 Initialization (global data) failed, status=0x0000ff03.