How do I suppress messages from sfmdb?

[Karen Birkelbach]

On several Itanium servers of various types running HP-UX 11.23 we're this getting message in syslog.log

Apr 25 08:05:50 qr3-d-1 su: + tty?? root-sfmdb

They come out every 15 minutes. Is there an easy way to suppress these messages?

Thanks!

[Ivan Krastev]

This messages is from su command.Bu default "su" logs every attempt to syslog.file with "+" for successful and "-" for failure. This maybe a crontab script running as sfmdb user - check you crontabs.



regards,
ivan

[Ivan Krastev]

Also see this doc - http://www4.itrc.hp.com/service/cki/docDisplay.do?docLocale=en&docId=emr_na-c01006933-1

"How to stop su messages from being logged to syslog.log?"

DocID is emr_na-c01006933-1


regards,
ivan

[Marco A.]

If those are info messages, you can configure that throught the /etc/syslog.conf file, defining what you really want to be logged, and what you really want to see in the console.

Hope this helps,

Rgds,

[Karen Birkelbach]

I was actually trying to find an answer via the SFM utility, not syslog. Any ideas?

[Marco A.]

Actually I don't believe that you can do that throught the same application, sfm is a small application , and is opensource, how I told you, I don't believe that you can stop the application logging, but try contacting the application author. : pixel@france-mail.com , is open to answer question about it, or report bugs.

I hope this helps,

Rgds,

[Andrew Merritt_2]

Hi Karen,

In this instance, SFM is SysFaultMgmt, the future replacement for the HP-UX OnlineDiags, so no need to email innocent third-parties!

As suggested above, the logging is actually a result of the 'su' command being called from a script. Configuring syslog may well let you hide these.

What version of SFM do you have installed on your systems? I don't think the current versions should be logging this message every 15 minutes, so upgrading to the current version will probably fix this. As far as I know, the current version only uses 'su' when the start-up script is run, usually as part of system start-up.

Andrew

[Karen Birkelbach]

Here's the version information on my system. They're all the same.

>swlist -l fileset SFM-CORE
# Initializing...
# Contacting target "hostname"...
#
# Target: hostname:/
#

# SFM-CORE B.03.00.04 HPUX System Fault Management
SFM-CORE.CTR_PRO_COMM B.03.00.04 Control Provider Common Fileset
SFM-CORE.CTR_PRO_COREIA B.03.00.04 Control Provider Platform Specific Fileset
SFM-CORE.EMT_COMM B.03.00.04 EMT Common components
SFM-CORE.EMT_COREIA B.03.00.04 EMT core platform specific fileset
SFM-CORE.EVWEB_COMM B.03.00.04 Event Manager (EvWEB) Common components
SFM-CORE.EVWEB_COREIA B.03.00.04 EvWEB core platform specific fileset
SFM-CORE.EVWEB_DOC B.03.00.04 EvWEB Online help fileset
SFM-CORE.EVWEB_GUI_COMM B.03.00.04 EvWEB GUI common fileset
SFM-CORE.EVWEB_GUI_IA B.03.00.04 EvWEB GUI platform specific fileset
SFM-CORE.EVWEB_MAN B.03.00.04 EVWEB Man pages fileset
SFM-CORE.FMD_PRO_COMM B.03.00.04 Filter Metadata Instance Provider Common Fileset
SFM-CORE.FMD_PRO_COREIA B.03.00.04 Filter Metadata Instance Provider Platform Specific Fileset
SFM-CORE.GS_COMM B.03.00.04 General Services Common Fileset
SFM-CORE.GS_COREIA B.03.00.04 General Services Platform Specific Fileset
SFM-CORE.HAS-IA B.03.00.04 Hardware Access ServicesIA
SFM-CORE.HS_PRO_COREIA B.03.00.04 HealthState Instance Provider Platform Specific Fileset
SFM-CORE.MISC_COMM B.03.00.04 MISC Common Fileset
SFM-CORE.MISC_COREIA B.03.00.04 MISC Platform Specific Fileset
SFM-CORE.SFM_PRO_COMM B.03.00.04 SysFaultMgmt Provider Module COMMON
SFM-CORE.SFM_PRO_IA B.03.00.04 SysFaultMgmt Provider Module IA

[Andrew Merritt_2]

Hi Karen,

You can see the current versions of SFM here - http://docs.hp.com/en/diag/sfm/sfm_table.htm

There are two versions newer than B.03.00.04; but I don't think you should be seeing this problem with that release. (I don't see it on my server running B.03.00.04.)

I'm surprised that you are getting this logged every 15 minutes. I would expect to see it when SFM starts up, as the rc script is executed (/sbin/rc2.d/S550sfmdb) which uses 'su', but not after that.

Can you check the crontab files to see if any of those have an 'su' to sfmdb? Are there any other unexpected messages in syslog?

Andrew