hp-ux 11.11 crashes

[Senthil prabu.S]

Experts,
I have build Nessus-2.0.12 with libpcap-0.83 on my hp-ux 11.11 machine.When I started scanning,everything went well,but within few minutes,CPU utilisation of nessusd increased to nearily 75%.And OS crashed.Also I found peculiar messages in log.

Could anyone help me to overcome this issue.


Following are my log messages.
recv_ack: promisc_sap: UNIX error - Device busy
mmap: Not enough space
recv_ack: promisc_sap: UNIX error - Device busy
recv_ack: promisc_sap: UNIX error - Device busy
.
.It gones on this way..........

What this message tells,is the problem with libpcap???.
Do I need to alter anything in it's code and rebuil libpcap?

TOP command gives this,at the time of crash:
# top
System: xxxxx Wed Sep 15 17:42:17 2004
Load averages: 0.47, 0.35, 0.22
172 processes: 158 sleeping, 13 running, 1 zombie
Cpu states:
CPU LOAD USER NICE SYS IDLE BLOCK SWAIT INTR SSYS
0 0.48 33.3% 0.0% 4.0% 62.7% 0.0% 0.0% 0.0% 0.0%
1 0.45 83.7% 0.0% 2.8% 13.5% 0.0% 0.0% 0.0% 0.0%
--- ---- ----- ----- ----- ----- ----- ----- ----- -----
avg 0.47 58.6% 0.0% 3.4% 38.0% 0.0% 0.0% 0.0% 0.0%

Memory: 206108K (120352K) real, 514044K (377372K) virtual, 188080K free Page# 1/5

CPU TTY PID USERNAME PRI NI SIZE RES STATE TIME %WCPU %CPU COMMAND
0 ? 27702 root 220 20 7308K 2656K run 0:29 83.23 74.01 nessusd
0 pts/td 27698 root 154 20 13776K 5632K sleep 0:10 4.52 4.27 nessus
1 ? 27699 root 154 20 7136K 2500K sleep 0:08 4.13 3.91 nessusd
0 ? 664 www 152 20 83132K 19584K run 0:19 0.81 0.81 ns-slapd
1 ? 28053 root 154 20 8236K 3584K sleep 0:00 0.00 0.49 nessusd
0 ? 35 root 152 20 1888K 1888K run 0:45 0.36 0.36 vxfsd
0 ? 707 root 152 20 247M 19284K run 0:33 0.30 0.30 ns-httpd
0 ? 28052 root 154 20 7468K 2816K sleep 0:00 5.01 0.24 nessusd
1 ? 1247 root 152 20 14136K 3248K run 0:01 0.18 0.18 dmisp
1 pts/tg 27790 root 178 20 2524K 612K run 0:00 0.22 0.17 top
0 ? 27724 root 180 21 32K 32K zomb 0:00 0.17 0.15 nessusd
1 ? 28021 root 154 20 7372K 2732K sleep 0:00 0.31 0.12 nessusd
1 ? 1653 root 152 20 23312K 4156K run 0:01 0.10 0.10 vxsvc
1 ? 27716 root 154 20 7352K 2620K sleep 0:00 0.09 0.08 nessusd
0 ? 27718 root 154 21 7668K 2904K sleep 0:00 0.08 0.07 nessusd
0 ? 27727 root 154 21 7528K 2796K sleep 0:00 0.07 0.06 nessusd
0 ? 1336 root 154 20 2576K 336K sleep 0:01 0.05 0.04 pwgrd

[Muthukumar_5]

Error log information's of
recv_ack: promisc_sap: UNIX error - Device busy
mmap: Not enough space

say's,

your application nessusd running in the need of more memory.

Try to allocate / run the application in the memory added file system

Check the memory information's with bdf command. Try to analyse size the nessusd log file there. If it is going more in size then rotate in randomly with script / cron job there.

[Eric Antunes]

Hi,

Check your kernel parameter dbc_max_pct:

#kmtune -l -q dbc_max_pct

And your swap available space:

#swapinfo -t

Regards,

Eric

[Senthil prabu.S]

No muthukumar,
I have now freed the memory on the directory,where nessus runs and stores it's report and log.I have enough space,checked with bdf

But again,I am getting same log message as:

"recv_ack: promisc_sap: UNIX error - Device busy....................
.........

So I stopped Scan immediately,so that my OS will not get crashed.

I want to know correct reason,so that I can fix it and proceed Nessus scanning.

Any other hepls????????

[Senthil prabu.S]

Hi Eric,
Following are the output for those 2 commands,
# swapinfo -t
Kb Kb Kb PCT START/ Kb
TYPE AVAIL USED FREE USED LIMIT RESERVE PRI NAME
dev 4194304 0 4194304 0% 0 - 1 /dev/vg00/lvol2
reserve - 299440 -299440
memory 1575560 1148008 427552 73%
total 5769864 1447448 4322416 25% - 0 -
# kmtune -l -q dbc_max_pct
Parameter: dbc_max_pct
Current: 50
Planned: 50
Default: 50
Minimum: -
Module: -
Version: -
Dynamic: No
#

[Eric Antunes]

Hi Senthil,

I think you should decrease dbc_max_pct to 15%. Besides, check also if shmmax (kmtune -l -q shmmax) is setted to something like 2/3 of your memmory:

For exemple, if you have 1.5Gb memmory you should have shmamax setted to 1073741824. If you have 3Gb, set shmmax to 2147483648, ...

Regards,

Eric

[Senthil prabu.S]

Do they cont for this error.
I found the memory of my hp-ux-11.11 m/c with
the command "/etc/dmesg | grep -i phys"
it gives as,
# /etc/dmesg | grep -i phys
physical page size = 4096 bytes, logical page size = 4096 bytes
Physical: 2097152 Kbytes, lockable: 1572844 Kbytes, available: 1813120 Kbytes


And,
# kmtune -l -q shmmax
Parameter: shmmax
Current: 100663296
Planned: 100663296
Default: 0X4000000
Minimum: -
Module: -
Version: -
Dynamic: Yes

I think they look noraml.If they seems to be peculiar to U, plz help me........

[Eric Antunes · Accepted solution]

Hi Senthil,

Yes, you memmory looks normal.

But I think you kernel parameter dbc_max_pct is no good: decrease it to 15%. Increase shmmax to 1610612736 (2/3 of your 2Gb memmory)

You can do this on SAM->Kernel Configuration->Configurable Parameters->(Select the parameter you want to change)->Actions->Modify Configurable Parameter...

You'll need to reboot...

Eric Antunes