Odd /dev files and /dev files owned by users

[TedM]

The system in question is an HP9000 (K-420) running HP-UX 10.20. It runs an application I don't normally support, but the admin in charge of it asked me for help because I have some experience in HP-UX admin.

He called because he said he has to reboot his system every two to three weeks to clear 'hung logins'. Prior to his last reboot, I did a 'who -u' and saw several login entries with odd line names (instead of ttyp4, for example, the line name contained non-printing chars or extended-character set chars). After his reboot, I looked in /dev and found numerous ordinary files with names as I described. They simply contained the generic HP shutdown message, some from the last reboot, some from past reboots.

I suggested a way the admin could safely remove the bogus /dev files without removing others that really should be there. He did a good job of it, and the problem has not recurred since his last reboot (over two weeks ago). I'm assuming it wouldn't hurt to also do a cleanup of /etc/utmp and /var/adm/wtmp using the fwtmp utility, but still have a nagging feeling I haven't gotten to the root cause.

Besides the oddly-named /dev files, I did note one other strange thing whilst poking around in /dev. A range of /dev files (tty[pqr][0-f]) showed owner:group of users defined in the system rather than root:root or bin:tty. Everything else I saw in /dev had the ownership I expected to see.

This is not a critical problem, but was wondering if anyone in the forum might have experienced the /dev anomalies I've described. Thanks in advance.

Ted M.

[Chris Wilshaw]

Having device files with normal ID's as owners is correct. Normally, these are located in /dev/pts, and show which ones are currently in use.

for example,

On one of my systems, currently the logged in users (from who) are;

pg17142g pts/0 May 17 10:29 old 12639
cw16791n pts/1 Jun 3 16:43 . 21816
ukdpsd pts/4 Jun 1 11:55 old 16357
ukdpsd pts/7 Jun 3 09:12 7:13 27819

if I then go to /dev/pts, and run

ll | grep -v root

I get

total 0
crw--w---- 1 pg17142g tty 157 0x000000 Jun 2 13:18 0
crw--w---- 1 cw16791n tty 157 0x000001 Jun 3 16:43 1
crw--w---- 1 ukdpsd tty 157 0x000004 Jun 1 17:21 4
crw--w---- 1 ukdpsd tty 157 0x000007 Jun 3 09:29 7

As you can see, the ID's and device files match between the two.

It is possible that some files are left with incorrect owners (if for example a user crashes out of the system, rather than logging out cleanly)

I've not seen a problem like the other one you describe (extended character set), but I suspect that at some point this corruption has been entered into the utmp/wtmp files, and then the system broadcast on shutdown has created the files containing the shutdown message because it believes that it is writing to true device files.

[Rita C Workman]

Usually I see bogus files in /dev when somebody tries to tar a file and their syntax is wrong. So instead of going to the tape unit (or whatever) they wind up creating a bogus filename under /dev.

It is possible that something like that is going on....who owned the 'funny file'? - since you mention they show user names attached..maybe some folks just need a little 'instructional assistance' on syntax.

Just a thought,
Rita

[TedM]

Chris and Rita --

Thank you both for weighing in on my submission.

I suspect you are both right -- the admin tells me his users tend to drop their GUI while logged into the application rather than exiting the app in the proper manner. A little instruction to the users would probably alleviate the problem, but I don't have much hope that it would do much good.

I will direct the admin to look into possible utmp/wtmp corruption.

Ted M.