vxunix alert : settune of shmmax

[student_of_unix]

Jun 15 11:26:33 uacin003 vmunix: settune of shmmax to 12288000000 NOAUTO (NOPEND
ING) succeeded, now 12288000000


Can someone pls tell me what does above vmunix alert mean ?

did any one set the kernel parameters..if yes how do we check who did that.

[Don Morris_1 · Accepted solution]

I wouldn't call it an alert, that's just informational logging. Someone did a kmtune/kctune (depending on release) and set the dynamic kernel tunable shmmax to 12288000000. Considering you have to have administrator privileges to do so, one would hope this was expected -- but to track down who in particular did it, I'd check your security logs and see who was logged on or su'd to superuser account status at the time.

[Duncan Edmonstone]

Assuming the person used kcweb or kctune to chnage the kernel parm then:

kclog -t tunable -n shmmax

Should tell you when it was done and by who (although it might just say 'by root')

HTH

Duncan

[A. Clay Stephenson]

It means just what it says. Someone has invoked the settune() system call; it could have been done from a C program but most likely it was done by a command such as kmtune or kctune. All settune changes are logged automatically in syslog. Man 2 settune for details.

There is no need to check who did it; you already know --- someone with an effective UID = 0. Of course, if you don't know who can become a super-user then you have a much bigger problem. This could also have been done inside a setuid root program.

[student_of_unix]

thanks