inetd was killed - how do I figure out why ?????

[Glen Brittle]

HP-UX 11.11 on HP9000 server
Symptom: Telnet stopped accepting new connections
What I found: inetd was not running
Fixed by : /sbin/init.d/inetd start

What I cant figure out is what killed it. The only entry in syslog.log was :

Aug 23 07:30:02 mysystem inetd[800]: Going down on signal 15

Any Ideas on what to look at ? Where to look ?

Thanks in advance
Glen

[Patrick Wallek]

If you have history enabled, check roots history file and see if anyone did a '/sbin/init.d/inetd stop' or a 'kill '.

[A. Clay Stephenson]

Inetd is such an important daemon that I have a cronjob that runs every 5 minutes to see if it is running and restart it if necessary.

[A. Clay Stephenson]

I would add the following script as a cronjob that runs fairly often. This will save you a trip to the office at 0300 to restart inetd from the console.
--------------------------------------------
#!/usr/bin/sh

# Checks to see that inetd is running
# 07/27/1998 acs only execute in run level 3

typeset PROCESS=inetd
typeset TDIR=${TMPDIR:-/var/tmp}

typeset LOG=${TDIR}/inetdchek.log
typeset ERRLOG=${TDIR}/inetdchek.err

readonly PROCESS LOG ERRLOG

PATH=/usr/bin:${PATH}
export PATH

run_state()
{
typeset -i RSTAT=0
typeset RS=$(who -r | awk '{ print $3 }')
RSTAT=${?}
if [[ ${RSTAT} -ne 0 ]]
then
RS="-1"
fi
echo "${RS}"
return ${RSTAT}
} # run_state

typeset -i STAT=0
typeset RS1=$(run_state)
STAT=${?}

if [[ "${RS1}" -ne 3 ]]
then
exit ${STAT}
fi

UNIX95="" ps -C ${PROCESS} -o pid= > /dev/null 2>&1
STAT=${?}

if [[ ${STAT} -ne 0 ]] # process not found
then
/sbin/init.d/${PROCESS} stop >> ${LOG} 2>>${ERRLOG}
sleep 5
/sbin/init.d/${PROCESS} start >> ${LOG} 2>>${ERRLOG}
STAT=${?}
fi

exit ${STAT}
-------------------------------------------
Because your inetd in this case received a SIGTERM and because the UID of this process is 0, the only user that could have sent the signal (ie a kill -15) to inetd was root. As Pogo said (or nearly so), "We have met the enemy and the enemy is us." In any event, I would cron the above script because it will restart inetd if it stops for whatever reason. Though it is not the problem in your case, I would also install the latest inetd cumulative patch because there were some problems which would cause inetd to crash.

[Glen Brittle]

Thank You for the feedback

- That script looks promising - I will give it a try.

- the history file showed nothing related to this :(

- Is there any way to trap (in the logs maybe) what process is sending the sigterm ? I like to solve problems instead of just finding a workaround.

Again , thanks . The hunt continues.

Glen

[Bill Hassell]

No, there is no way to log commands like kill (or rm or chmod, etc) except with a shell log. But (baad) sysadmins can bypass any log by changing shells (type the command /usr/old/bin/sh and you have a non-logging Bourne shell, or run vi and then escape to the shell with :!sh) As Clay said, only root can issue a kill -15 (which is also the same as kill with no parameters) and very likely, a sysadmin mistyped a process ID number.

[Glen Brittle]

Thanks Bill