netstat command either slow or coredumps

[John Poff]

Hi,

Does it core dump with different options or just with a particular set of options? Are you getting any useful information from the core dump? How well patched is the system that is having the errors? Any messages in syslog? Any errors in /var/adm/nettl.LOG00?

JP

[Ross Zubritski]

Reeks of Patches.

Regards,

RZ

[Sridhar Bhaskarla]

Hi,

Did you try with "-n" option so that it will output the IP addresses instead of trying to display them with names?.

For ex.,

netstat -in
netstat -rn

etc

-Sri

[John Waller]

Sorry , pressed and details submitted.

I have an interesting situation with the netstat command. Due to the companies requirements for Active Directories we have moved our DNS/DHCP server from HP-UX running bind 4.9.7 to a Suse Linux server running bind 9.1.3.
Since the move we have been having problems with the netstat and netstat -a command.

My initial problem was the the performance was slow, but I found another posting which suggested adding an entry into the hosts files as follows:
0.0.0.0 all-zeros-broadcast.

This at first did not improce performance but by implementing the /etc/nsswitch.conf file and putting an entry:
hosts: files dns
improved performance but this now coredumps. Again another forum posting recommended that you need to delete the nsswitch.conf file.

I have a resolv.conf listingg the domain and nameserver entries only.
What do I need to do to get netstat working quickly withour the coredump?

[John Waller]

John, nothing reported in /var/adm/nettl files, but the netstat -n and netstat -an commands do work correctly Sridhar, so the problem is with name resolution.

[Sridhar Bhaskarla]

Hi John,

One easiest way of doing it is to ensure all the IP addresses configured on the server are quickly resolvable. So put the corresponding entries in /etc/hosts file instead of going to the name server.

However, this will add on to your maintenance a lot. So, usually I do not use netstat without '-n' option particularly if my system is having too many configured network interfaces.

-Sri

[John Waller]

Sridhar, I've given your second response 3 to give you 10 in total as this the -n option does allow the command to work sucessfully, but I would still be interested if their is a more official line where by a netstat or netstat -a works as it was not a problem when we were using the older version of bind.

[harry d brown jr]

John,

I'm running Bind 9 on my HPux server (11i & fully patched) and I also notice the long time it takes to complete, but I don't get core dumps. It usually hangs on the "Active UNIX domain sockets" area of "netstat -a".

I'm going down to my lab and testing this with my network sniffer to see what the hell it is doing (like DNS queries). I'm in the midst of setting up my server to behave as a DNS Caching Server and things like this I need to resolve (or HP does :-)).

B back to u l8tr

live free or die
harry

[Colin Topliss]

I'd take a look at netstat:

test1:/usr/bin=> what netstat
netstat:
netstat.c $Date: 2002/04/25 15:53:10 $Revision: r11.11/7 PATCH_11.11 (PHNE_26762)
osstat.c $Date: 2002/03/03 15:14:52 $Revision: r11.11/4 PATCH_11.11 (PHNE_25644)

and make sure you're patched up.
Had something similar which turned out to be a patch issue (netstat just seemed to hang).

[harry d brown jr]

OOPS, I take some of that back, it's hanging on the UDP area, specifically LOCALHOST! I'm sure I have a config issue. Damn!

Again I'll be back

live free or die
harry

[harry d brown jr]

Colin,

I have mine patched:

# what /usr/bin/netstat
/usr/bin/netstat:
netstat.c $Date: 2002/04/25 15:53:10 $Revision: r11.11/7 PATCH_11.11 (PHNE_26762)
osstat.c $Date: 2002/03/03 15:14:52 $Revision: r11.11/4 PATCH_11.11 (PHNE_25644)

#

I believe it's a DNS configuration issue.

live free or die
harry

[John Waller]

Harry, As mentioned above, you can improve performance by adding the entry:
0.0.0.0 all-zeros-broadcast
to the /etc/hosts file if you can get the server to look at hosts before dns (hence using the /etc/nsswitch.conf which according to a previous posting caused the coredump)

Colin, We are running hp-ux 11.00, so we get the following:
/usr/bin # what netstat
netstat:
netstat.h 8.1
PHNE_17434 netstat.c $Revision: @@/main/r11ros/8$
netstat.c 9.1
NET: Version: B.11.00 $Date: 97/10/15 10:44:23 $
netstat.h 8.1
osstat.c 6.9
netstat.h 8.1
PHNE_17434 osstat.c $Revision: @@/main/r11ros/7$
osstat.c 6.9
vmmap.o $Revision: 82.2 $

Any ideas on which patches are required for 11.00 would be appreciated.

[Colin Topliss]

John, I seem to recall that there is a section in there which tells you the equivalents. However, I checked this against the patches I mentioned, and this section just says none.

I'm afraid we don't have any 11.0 systems here for me to check for you.

Doing a keyword search in the ITRC patch section brings back a bunch of patches which mention netstat - haven't gone through them all though to see if any are relevant to you.

Harry, as for a resolver issue - it should be possible to test this quite easily. Just remove 'dns' from the hosts line in nsswitch.conf - that will stop DNS being queried. Try again, and you may find that the response is much quicker. If that is the case, then the DNS servers need to be looked at. If it is not the case, then the problem lies elsewhere (not sure if you tried this approach in your lab).

[Steven E. Protter]

Try analyzing the core file?

Is there one.

Instructions attached.

SEP

[KCS_1]

hi,

I have ever been so similar problem around 3 month ago,

when I was excuting 'netstat -a' command ,i got coredump message from the command.

at first,

# cd /etc/
# cp inetd.conf inetd.conf.old
# cp /usr/newconfig/etc/inet.conf /etc/inetd.conf


and then, retry 'netstat -a'

[KCS_1]

hi,

I have ever been so similar problem around 3 month ago,

when I was excuting 'netstat -a' command ,i got coredump message from the command.

at first,

# cd /etc/
# cp inetd.conf inetd.conf.old
# cp /usr/newconfig/etc/inetd.conf /etc/inetd.conf


and then, retry 'netstat -a'

[KCS_1]

and then,

edit your /etc/nsswitch.conf

hosts: files [NOTFOUND=continue] dns


finally, retry again .


are you still have a problem??

[John Waller]

Steven, Your attachment only seems to be for a crashdump, I am experiencing a Memory Fault (coredump) the following gives further information:

/# file core
core: core file from 'netstat' - received SIGSEGV
/# what core
core:
netstat.h 8.1
PHNE_17434 netstat.c $Revision: @@/main/r11ros/8$
netstat.c 9.1
NET: Version: B.11.00 $Date: 97/10/15 10:44:23 $
netstat.h 8.1
osstat.c 6.9
netstat.h 8.1
PHNE_17434 osstat.c $Revision: @@/main/r11ros/7$
osstat.c 6.9
vmmap.o $Revision: 82.2 $
hosts $Revision: 1.9.214.1 $ $Date: 96/10/08 13:20:01 $
hosts $Revision: 1.9.214.1 $ $Date: 96/10/08 13:20:01 $
$ PATHCH/11.00:PHCO_16039 Jul 28 1998 16:05:28 $
libcrash $Revision: 1.5 $ SHARED
$ PATCH/11.00:PHCO_22076 Aug 16 2000 16:53:50 $
SMART_BIND
92453-07 dld dld dld.sl B.11.13 990903

Patrick , are you sure about copying the default inetd.conf ?? We have customized our current inetd.conf with respect to tftpd, ftpd, bootpd plus also other services like ignite and registrar which are reported in the default file.

I am now sure it is a patch issue as the lastest 11.00 system on our network works correctly, its only the older installations which are failing.

[KCS_1]

hi,again John.

why don't you use 'tusc' tool?

I recommend this solution to install and use "tusc" program in your hpux for solving your problem from http://hpux.cs.utah.edu/hppd/hpux/Sysadmin/tusc-7.3/

and then you can see tracing logs of 'netstat'command when you are excuting the command on hp-ux.

maybe you can find out some error when relating files are attempting close/open some files.

look at the tracing logs carefully.

this is one of solution from HPRC for solving coredump.