Logging - Kernel Parameter changes

[walter crasto_1]

Hi,

I have IA64 HP-UX system with OS HP-UX 11.23
It seems some one has change the kernel parameters. After words we have also done chages in kernel parameter in month of Jan.

Need to find out followings,
1> How many number of times the kernel parameters has been change in last 6 months.
2> What are the parameters has been change & who has made the changes.
3> If any other relevant information.

Thanks in advance.

Regards

Varian Crasto

[Jeff_Traigle]

Nothing built-in to the OS that will track this... unless auditing in Trusted system would help... even that won't tell you everything in itself, I think.

What changes were made would need to be monitored by running kmtune for a listing periodically and svaing them to compare. (Or maybe compare automatically what is running vs. what you have archived as what should be running.) Only root can make changes and rebuild kernels so, unless you have direct root logins disabled, including at the console, you may not be able to track down who specifically makes the changes.

[Rick Garland]

This is not recorded by the OS.

This is best kept as some kind of change control process.

Any changes (such as kernel changes) is documentated and presented. The change will be OK'd or DC'd and then recorded as part of the change control process.

[Carlos Roberto Schimidt]

In HP-UX 11.23 all changes from kernel parameter are record in file /var/adm/kc.log

For example:

======================================================================

Change to configuration 'nextboot'
at 14:10:33 GMTLA on 20 January 2006 by root:
Tunable 'shmmax' changed from '34359738368' to '68719476736'.


See too:

# man kclog

Good luck

[Steven E. Protter]

Shalom Varian,

You can write a script that does manual kernel production and keeps copies of the system file with the date appended.

Thats what I did when I was called upon to track that stuff at my prior job.

SEP

[Sanjay Yugal Kishore Ha]

Hi,

Try kclog command for most your needs for #s 1 and 2.

For other relevant information, you can bring up the Kernel Configuration web interface by typing http://:2301 on your browswer.

HTH,
Sanjay

[Muthukumar_5]

1> How many number of times the kernel parameters has been change in last 6 months.
2> What are the parameters has been change & who has made the changes.
3> If any other relevant information.

To answer this 3 question,

If you are having history logs for 6 months which will give details on changes by command line using kmtune or kctune.

May be sam log will give that too.

--
Muthu

[walter crasto_1]

Hi All,

Thanks a lot for your responses.
Please let me know in future if I need to track the kernel parameter changes then what will be the best options.
1> Make system in auditing mode ?
or
2> Take system file backup with date append.
or
3> Use kmtune command.

Thanks & regards

Varian Crasto

[Geoff Wild]

With iiiv2, you can use kcweb - allows you to put a comment in place for each parameter that you change.

Rgds...Geoff

[walter crasto_1]

Hi Geoff,

Can you please let me know how & when I can put the comments ?

Also what is iiiv2 ? I am not aware of this.

Regards

Varian

[Carlos Roberto Schimidt]

Hi Walter,

Is HP-UX 11iv2 not iiv2. Same as 11.23.

In this version you have to use kctune instead kmtune.

For add comments:

# kctune nproc=8192 -d "Subject for change"

Regards

Carlos Schimidt