Prev: Patch Downloads on Solaris 10 x86
Next: seaport absent
From: Anoop on 20 Feb 2007 13:50
On Feb 20, 4:16 am, Casper H.S. Dik <Casper....(a)Sun.COM> wrote:
> "Anoop" <anoopkum...(a)gmail.com> writes:
> >Whenever we use the command: "/usr/ucb/ps auxgwww" with 'grep java'
> >for example, we see that it writes a file to the /tmp file. Further
> >more the file it writes is owned by root/sys and we do not have the
> >access to root. Due to this we are seeing disk space issues on /tmp.
> >It seems many of our other processes also use /tmp to write buffer
> >files or something and those processes do not come up.
>
> What type of files does it write to /tmp?
>
> Are you *sure* it is Sun's version of /usr/ucb/ps?
> (Note that the actual binary is supposed to live under
> /usr/ucb/{sparcv7,sparcv9,i86,amd64}/ps)
>
> >So my question is why does /usr/ucb/ps have to write to /tmp (or
> >swap?) Is that behavior the same as ps. I mean would it be better if
> >we switch to ps (although we will have a tough time identifying our
> >processes).
>
> Tried pgrep?
>
> Casper
> --
> Expressed in this posting are my opinions. They are in no way related
> to opinions held by my employer, Sun Microsystems.
> Statements on Sun products included here are not gospel and may
> be fiction rather than truth.


Here are the additional details. I have aliased ps to point to /usr/
ucb/ps... (and ll to ls -ltr)

$ ll /tmp
-rw-rw-r-- 1 root sys 647384 Feb 20 09:33 ps.fRaWKW
-rw-rw-r-- 1 root sys 647384 Feb 20 09:33 ps.1Ma4IW
-rw-rw-r-- 1 root sys 647384 Feb 20 09:34 ps.j4aW8X
-rw-rw-r-- 1 root sys 647384 Feb 20 09:34 ps.g8aG.X
-rw-rw-r-- 1 root sys 647384 Feb 20 11:32 ps.wyaGVV
-rw-rw-r-- 1 root sys 647384 Feb 20 11:32 ps.puaOTV
-rw-rw-r-- 1 root sys 647384 Feb 20 11:32 ps.8Kaq7W
-rw-rw-r-- 1 root sys 647384 Feb 20 11:32 ps.sPaq9W
-rw-rw-r-- 1 root sys 647384 Feb 20 11:32 ps.nnaafY
-rw-rw-r-- 1 root sys 647384 Feb 20 11:32 ps.ijaidY
-rw-rw-r-- 1 root sys 647384 Feb 20 12:44 ps.TEa4rG
-rw-rw-r-- 1 root sys 647384 Feb 20 12:44 ps.7IaWtG
-rw-rw-r-- 1 root sys 647384 Feb 20 13:13 ps.2YaWKX
-rw-rw-r-- 1 root sys 647384 Feb 20 13:13 ps.W8aqOX
-rw-rw-r-- 1 root sys 647384 Feb 20 13:13 ps.GhaGRX
-rw-rw-r-- 1 root sys 647384 Feb 20 13:14 ps.25ai5X
-rw-rw-r-- 1 root sys 647384 Feb 20 13:15 ps.m2aGOY
-rw-rw-r-- 1 root sys 647384 Feb 20 13:15 ps.MXayMY
-rw-rw-r-- 1 root sys 647384 Feb 20 13:18 ps.3BaWi2
-rw-rw-r-- 1 root sys 647384 Feb 20 13:18 ps.0xaGg2


Monitoring the /tmp size using du -k /tmp every 3 seconds) and running
ps auxgwww in between - see the spikes....
151864 /tmp
151864 /tmp
151864 /tmp
151864 /tmp
151864 /tmp
152504 /tmp <--
152504 /tmp
153144 /tmp <--
153784 /tmp
153784 /tmp
153784 /tmp
153784 /tmp
153784 /tmp
154424 /tmp <--
154424 /tmp
154424 /tmp
154424 /tmp
154424 /tmp
155704 /tmp <--
155704 /tmp
155704 /tmp


$ll /tmp
-rw-rw-r-- 1 root sys 647384 Feb 20 09:33 ps.fRaWKW
-rw-rw-r-- 1 root sys 647384 Feb 20 09:33 ps.1Ma4IW
-rw-rw-r-- 1 root sys 647384 Feb 20 09:34 ps.j4aW8X
-rw-rw-r-- 1 root sys 647384 Feb 20 09:34 ps.g8aG.X
-rw-rw-r-- 1 root sys 647384 Feb 20 11:32 ps.wyaGVV
-rw-rw-r-- 1 root sys 647384 Feb 20 11:32 ps.puaOTV
-rw-rw-r-- 1 root sys 647384 Feb 20 11:32 ps.8Kaq7W
-rw-rw-r-- 1 root sys 647384 Feb 20 11:32 ps.sPaq9W
-rw-rw-r-- 1 root sys 647384 Feb 20 11:32 ps.nnaafY
-rw-rw-r-- 1 root sys 647384 Feb 20 11:32 ps.ijaidY
-rw-rw-r-- 1 root sys 647384 Feb 20 12:44 ps.TEa4rG
-rw-rw-r-- 1 root sys 647384 Feb 20 12:44 ps.7IaWtG
-rw-rw-r-- 1 root sys 647384 Feb 20 13:13 ps.2YaWKX
-rw-rw-r-- 1 root sys 647384 Feb 20 13:13 ps.W8aqOX
-rw-rw-r-- 1 root sys 647384 Feb 20 13:13 ps.GhaGRX
-rw-rw-r-- 1 root sys 647384 Feb 20 13:14 ps.25ai5X
-rw-rw-r-- 1 root sys 647384 Feb 20 13:15 ps.m2aGOY
-rw-rw-r-- 1 root sys 647384 Feb 20 13:15 ps.MXayMY
-rw-rw-r-- 1 root sys 647384 Feb 20 13:18 ps.3BaWi2
-rw-rw-r-- 1 root sys 647384 Feb 20 13:18 ps.0xaGg2
$ file ps.0xaGg2
ps.0xaGg2: data
$ ps auxgwww | grep XX
ps: rename("/tmp/ps.JIa4vb","/tmp/ups_data") failed, Permission denied
ps: Please notify your System Administrator
wlitid 688 0.0 0.0 1008 736 pts/14 S 13:27:06 0:00 grep XX
$ ll /tmp
-rw-rw-r-- 1 root sys 647384 Feb 20 09:33 ps.fRaWKW
-rw-rw-r-- 1 root sys 647384 Feb 20 09:33 ps.1Ma4IW
-rw-rw-r-- 1 root sys 647384 Feb 20 09:34 ps.j4aW8X
-rw-rw-r-- 1 root sys 647384 Feb 20 09:34 ps.g8aG.X
-rw-rw-r-- 1 root sys 647384 Feb 20 11:32 ps.wyaGVV
-rw-rw-r-- 1 root sys 647384 Feb 20 11:32 ps.puaOTV
-rw-rw-r-- 1 root sys 647384 Feb 20 11:32 ps.8Kaq7W
-rw-rw-r-- 1 root sys 647384 Feb 20 11:32 ps.sPaq9W
-rw-rw-r-- 1 root sys 647384 Feb 20 11:32 ps.nnaafY
-rw-rw-r-- 1 root sys 647384 Feb 20 11:32 ps.ijaidY
-rw-rw-r-- 1 root sys 647384 Feb 20 12:44 ps.TEa4rG
-rw-rw-r-- 1 root sys 647384 Feb 20 12:44 ps.7IaWtG
-rw-rw-r-- 1 root sys 647384 Feb 20 13:13 ps.2YaWKX
-rw-rw-r-- 1 root sys 647384 Feb 20 13:13 ps.W8aqOX
-rw-rw-r-- 1 root sys 647384 Feb 20 13:13 ps.GhaGRX
-rw-rw-r-- 1 root sys 647384 Feb 20 13:14 ps.25ai5X
-rw-rw-r-- 1 root sys 647384 Feb 20 13:15 ps.m2aGOY
-rw-rw-r-- 1 root sys 647384 Feb 20 13:15 ps.MXayMY
-rw-rw-r-- 1 root sys 647384 Feb 20 13:18 ps.3BaWi2
-rw-rw-r-- 1 root sys 647384 Feb 20 13:18 ps.0xaGg2
-rw-rw-r-- 1 root sys 647384 Feb 20 13:27 ps.JIa4vb
$ uname -a
SunOS mumu 5.8 Generic_117350-39 sun4u sparc SUNW,Sun-Fire-880
$


Thanks,
Anoop

From: Darren Dunham on 20 Feb 2007 14:18
Anoop <anoopkumarv(a)gmail.com> wrote:

> $ file ps.0xaGg2
> ps.0xaGg2: data
> $ ps auxgwww | grep XX
> ps: rename("/tmp/ps.JIa4vb","/tmp/ups_data") failed, Permission denied
> ps: Please notify your System Administrator
> wlitid 688 0.0 0.0 1008 736 pts/14 S 13:27:06 0:00 grep XX
> $ ll /tmp
> -rw-rw-r-- 1 root sys 647384 Feb 20 09:33 ps.fRaWKW

[...]

So it's telling you that there's a problem with renaming to
/tmp/ups_data. The other tmp files are owned by root, so it should have
permissions to rename as well. Is /usr/ucb/ps setuid?

--
Darren Dunham ddunham(a)taos.com
Senior Technical Consultant TAOS http://www.taos.com/
Got some Dr Pepper? San Francisco, CA bay area
< This line left intentionally blank to confuse you. >
From: Anoop on 20 Feb 2007 14:57
On Feb 20, 2:18 pm, Darren Dunham <ddun...(a)redwood.taos.com> wrote:
> Anoop <anoopkum...(a)gmail.com> wrote:
> > $ file ps.0xaGg2
> > ps.0xaGg2: data
> > $ ps auxgwww | grep XX
> > ps: rename("/tmp/ps.JIa4vb","/tmp/ups_data") failed, Permission denied
> > ps: Please notify your System Administrator
> > wlitid 688 0.0 0.0 1008 736 pts/14 S 13:27:06 0:00 grep XX
> > $ ll /tmp
> > -rw-rw-r-- 1 root sys 647384 Feb 20 09:33 ps.fRaWKW
>
> [...]
>
> So it's telling you that there's a problem with renaming to
> /tmp/ups_data. The other tmp files are owned by root, so it should have
> permissions to rename as well. Is /usr/ucb/pssetuid?
>
> --
> Darren Dunham ddun...(a)taos.com
> Senior Technical Consultant TAOS http://www.taos.com/
> Got some Dr Pepper? San Francisco, CA bay area
> < This line left intentionally blank to confuse you. >



>>>>>>>Is /usr/ucb/ps setuid?

How do I find that out?

Will this help??

$ grep "/ps " /var/sadm/install/contents | grep 4555
/usr/bin/sparcv7/ps f none 4555 root sys 29196 23101 1121447849
SUNWcsu
/usr/bin/sparcv9/ps f none 4555 root sys 38536 8940 1121447849
SUNWcsxu
$

Thanks,
Anoop

From: Anoop on 20 Feb 2007 14:58
On Feb 20, 2:18 pm, Darren Dunham <ddun...(a)redwood.taos.com> wrote:
> Anoop <anoopkum...(a)gmail.com> wrote:
> > $ file ps.0xaGg2
> > ps.0xaGg2: data
> > $ ps auxgwww | grep XX
> > ps: rename("/tmp/ps.JIa4vb","/tmp/ups_data") failed, Permission denied
> > ps: Please notify your System Administrator
> > wlitid 688 0.0 0.0 1008 736 pts/14 S 13:27:06 0:00 grep XX
> > $ ll /tmp
> > -rw-rw-r-- 1 root sys 647384 Feb 20 09:33 ps.fRaWKW
>
> [...]
>
> So it's telling you that there's a problem with renaming to
> /tmp/ups_data. The other tmp files are owned by root, so it should have
> permissions to rename as well. Is /usr/ucb/pssetuid?
>
> --
> Darren Dunham ddun...(a)taos.com
> Senior Technical Consultant TAOS http://www.taos.com/
> Got some Dr Pepper? San Francisco, CA bay area
> < This line left intentionally blank to confuse you. >


But why is the ps even trying to touch /tmp? And that too create files
as root. IMO not very secure. Or maybe there is a completely diff
use / view to this..

From: gerryt on 20 Feb 2007 15:24
On Feb 20, 11:57 am, "Anoop" <anoopkum...(a)gmail.com> wrote:
> On Feb 20, 2:18 pm, Darren Dunham <ddun...(a)redwood.taos.com> wrote:
>
>
>
> > Anoop <anoopkum...(a)gmail.com> wrote:
> > > $ file ps.0xaGg2
> > > ps.0xaGg2: data
> > > $ ps auxgwww | grep XX
> > > ps: rename("/tmp/ps.JIa4vb","/tmp/ups_data") failed, Permission denied
> > > ps: Please notify your System Administrator
> > > wlitid 688 0.0 0.0 1008 736 pts/14 S 13:27:06 0:00 grep XX
> > > $ ll /tmp
> > > -rw-rw-r-- 1 root sys 647384 Feb 20 09:33 ps.fRaWKW
>
> > [...]
>
> > So it's telling you that there's a problem with renaming to
> > /tmp/ups_data. The other tmp files are owned by root, so it should have
> > permissions to rename as well. Is /usr/ucb/pssetuid?
>
> > --
> > Darren Dunham ddun...(a)taos.com
> > Senior Technical Consultant TAOS http://www.taos.com/
> > Got some Dr Pepper? San Francisco, CA bay area
> > < This line left intentionally blank to confuse you. >
> >>>>>>>Is /usr/ucb/ps setuid?
>
> How do I find that out?
>
> Will this help??
>
> $ grep "/ps " /var/sadm/install/contents | grep 4555
> /usr/bin/sparcv7/ps f none 4555 root sys 29196 23101 1121447849
> SUNWcsu
> /usr/bin/sparcv9/ps f none 4555 root sys 38536 8940 1121447849
> SUNWcsxu

Who cares whats in /var/sadm/install/contents? That could easily
be out of sync with reality : /

Anyway I have access to Sol 8 box. I see no symptoms like you
describe.
Secondly it appears you are way behind in patches some of which
fix SUNWscpu(x) issues but I did not see anything about /tmp and
ps specifically.

What I do see is 2 db files in /tmp:
ps_data and ups_data (which was updated when I ran a ps).
Thats it. Maybe DD is on to something



First  |  Prev  |  Next  |  Last
Pages: 1 2 3 4 5
Prev: Patch Downloads on Solaris 10 x86
Next: seaport absent