Worrying message on HP-UX 11.00

[Open Systems_1]

Firstly, let me say I am by no means a HP-UX expert so forgive me if this question is stupid or way off.

A message appeared in some logs of a HP-UX system:

"Due to misuse, a reboot is required"

This message appeared in the logs of our software product but is not generated from any of our code. I am suspecting that some HP-UX command that we invoke in the day to day life of our product on HP has produced this error, but again, I can't be more specific. The system was, in fact, rebooted and the message no longer appears.

I am, however, interested to find out if anyone knows the origin of this!

Thanks....

[linuxfan]

Hi,

You said, the message appeared in the logs of your product? Was the application writing to the system log file in /var/adm/syslog/syslog.log?

Also was there multiple occurences of this message in the log file?

-Regards
Ramesh

[eran maor]

Hi

i have never seen this error acour .
search also in our database for this kind of error - didnt found nothing .

i think that mybe a 3party applic gave this error .

i also think that you will never see this error in the syslog or the dmesg.

if you will give the logfile that you found the error mybe i could tell you which applic it this .

but i m 99% that this is not an hp-ux error because i would have found it .

[Sridhar Bhaskarla]

I used to scare my colleguess before by sending those messages to syslog using logger command.
I am also pretty sure that it is not a default syslog entry. Please check your scripts.

-Sri

[Open Systems_1]

Yes. Whilst I'm 100% sure its not from our application code, I too had drawn a blank searching HP documentation.

Perhaps it's coming from Oracle (8.1.7) or COBOL (more likley Oracle I think).

Thanks for the responses. Ultra fast.

[harry d brown jr]

Search for the string.

find / -type f -exec grep -il "due to misuse" {} \;

From my searches, it's not from HPux, and not from Oracle.

[linuxfan]

Hi,

The reason i asked if you were seeing this messages in /var/adm/syslog/syslog.log is because anyone can write to it using logger command.

As a regular user try this
logger "Due to misuse, system reboot is required"

now look at the syslog.log and you will see your loginid associated with the message,

but now try this

logger -t ROOT "due to misuse, system reboot is required"

see the difference, the only way you can prevent this is by changing the permissions of /usr/bin/logger to 750 and/or changing the group as well and assigning certain users to that group.

-Ramesh

[Open Systems_1]

In answer to another question, the message did not appear in syslogs but in a variety of our application logs, and some instances of it being displayed on interactive terminal sessions.

But as the thing is no longer being output, I fear it will be quite difficult to get to the bottom of it.

[Paula J Frazer-Campbell]

Hi

Which logs have you seen this message in ?

One thing not mentioned was a security breach, are your security checks showing anything?

Paula

[Open Systems_1]

Perhaps I should clarify.

I work in the Open Systems (read: Porting) team of a software house. Our application runs on OS/390, HP-UX, NT, AIX, Solaris and Dynix/PTX. This message appeared in the logs of our own application, and also at the interactive terminals of the people trying to use our software.

I can't check the security as the system in question is a customer system. The customer wishes to know (from me, the application developer) where this worrying looking message came from. Hence this discussion here!

[harry d brown jr]

The message is not from HPux. It could have possibly been someone with root permissions issuing a "wall" or a "write", but it would have displayed this for a wall:
Broadcast Message from root (ttyp1) Thu Aug 30 11:42:17...

and this for write:
Message from root (ttyp1) [ Thu Aug 30 11:49:45 ] ...

if you didn't receive these headers to the messages, and you don't suspect someone playing with the syslog logger, then I would look into your application software.

[Sridhar Bhaskarla]

Obviously since this appearing in the application logs, I would check the application first.

But I wonder why they have to send this message to reboot the server if their application is misused?... I hope this application is not run with root previliges.

From a logical point of view, this message is very immature and doesn't sound technical.

-Sri

[Sridhar Bhaskarla]

Hi,

I read your message again. And it's interesting.

If the system has to write this message on it's own, I think it is impossible as by default the system wouldn't know where the application logs are located.

It's the same case with oracle or any other third party software.

This takes us to the situation where someone in your team might have played around by simply doing an echo "misused reboot"
to the log files.

Or, it could be a check in the application itself somewhere the produces this message upon executing some wrong application commands.
But you are sure that there is nothing like that in the application.

So, you can do one thing. Go to the directory where the users are residing (/home or /users)
and do a

find . -name .sh_history -print -exec grep misuse {} \;

And see if you can find someone with this word in his/her shell history.

-Sri

[someone_4]

hello
This is a very intresting post. Because I am leaning towards someone playing a joke.Could it be that the message was miss written? Maybe all the message ment to say was to restart the application or software. Of course when you rebooted the server you had to restart the app.

Richard

[Wodisch]

High,

I would not search for/in scripts only, but codefiles, too:

MSG="due to misue,"

find / -type f -print | while read name
do case "$(file $name)" in
*text*) cmd="cat" ;;
*) cmd="strings" ;;
esac

if $cmd "$name" | grep "$MSG" > /dev/null
then echo "found it: $name"
fi
done

But I am pretty certain that you will not find an HP-UX
command, but something else...
Oh, and do you have other computers filesystems
mounted over NFS? Then you will have to check those,
too!

HTH,
Wodisch

[David Ritchie]

This is most likely a MicroFocus cobol error message - from looking out on Google, it appears to be caused when shared memory segments associated with the compiler license manager get corrupted

[Ben Dehner]

We're seeing this error on HP-UX 11.i. We're running Peoplesoft application, using Merant Cobol. This error message is caused by a corrupt memory segment in the license manager shared memory.

I'm not sure how to fix it other than rebooting, though.

[Steven E. Protter]

This is a message from Merant. I've seen it.

It is quite obnoxious and quite untrue. Reboot will not help, though it might disable the cobol compiler.


I got it when the Merant license database became corrupt due to an Ignite restore or a problem with the application.

There are procedures in the Merant documentation for rebuilding the license database. These are version specific. If you are using Merant cobol, contacting their support is the best option.

Or post your version number and if its comptabible with mine, I'll post a procedure.

SEP

[Ben Dehner]

We've got Merant 2.0.10 (I think), and if you've got something that can fix this I'd love to see it. We're going to try a reboot anyway, since Cobol can't get any more broke than it already is.