failed sys calls in audit log

[Michael Ernstoff]

I switched C2 audit logging on a server recently (normally left off due to space considerations).
I was surprised to see that in one hour there were 3 million failed "close" system calls, and only half a million successful "close" system calls.
All failed "close" calls were because "fildes is not a valid open file descriptor".
Is this typical? or does it indicate a problem?
How do I dig deeper?
I am running HP-UX 11i version 1.
Application is using Oracle 10.20 and most of the failed system calls were oracle or the application ID.

[Steven E. Protter]

Shalom,

An application is badly managing its open/close system calls.

Most likely its not serious but I would look to http://metalink.oracle.com to find a bug fix for the applications.

SEP

[Michael Ernstoff]

Sounds reasonable, but what does "application is badly managing" actually mean?

[Dennis Handly]

>but what does "application is badly managing" actually mean?

It means a well written application only closes files that it opened successfully.

Though I've seen (using tusc) the shell try to close a whole bunch of files in sequential order.

[Dennis Handly]

Something like this for ksh:
close(2046) .. ERR#9 EBADF
close(2045) .. ERR#9 EBADF
close(2044) .. ERR#9 EBADF
close(2043) .. ERR#9 EBADF
close(2042) .. ERR#9 EBADF
close(2048) .. ERR#9 EBADF
close(2047) .. ERR#9 EBADF

[Michael Ernstoff]

So is this unusual? typical?
Anyone see similar results for Oracle systems?

[Dennis Handly]

>So is this unusual? typical?

This is typical for ksh and probably sh. (It is freeing a parking space for the FDs 0-9?) But I wouldn't think an application would do this.