[RndTbl] Obscure Solaris email?

[Daryl F]

On Thu, 24 Oct 2013, Kevin McGregor wrote:

> We've been getting email from one of our Solaris 10 servers, and I can't
> figure out precisely where it's coming from. It's a system call "Auto
> Service Request" or ASR, and produces and email like this:
> You requested the following events be forwarded to you from wwdsvpciss2
>
> Site       : City of Winnipeg 510 Main St
> Agent      : wwdsvpciss2
> Severity   : Major
> Category   : agent
> Device Id  : wwdsvpciss2
> Topic      : System
> Event Type : NotifierFailedEvent
> Event Code : 4.72.582
> Event Date : 2013-09-26 03:29:30
>
> Description:
> An attempt to contact the ASR server resulted in a Connection timed out
> failure.
>
>
> Probable Cause:
> The ASR has indicated a problem processing the posted data.
> The cause may be due to an internal server failure, invalid settings
> locally, or due to the
>
>
> Recommended Action:
> Examine the reason indicated in the description.
> If the reason indicates a server failure, then back end support will need
> to be notified.
> If the connection was refused, verify the Sun Connection Configuration
> settings first, then verify with back end support that the server is
> operational.
>
>
> It seems like there is a package responsible for this called "SUNWswasr"
> except that's not installed on this machine! I've checked all kinds of logs
> and it also doesn't seem to have a trace in crontab. Magic? Please suggest
> some other places to look! We want to stop getting these messages or at
> least direct them to a different account.
>
> Thanks,
> Kevin
>

ASR is driven by SNMP traps. The are supposed to rendezvous at one server 
at your site that is connected to Oracle's backend. New machines 
automatically send these. Check the offending machines 
/etc/sma/snmp/snmpd.conf . If you see something like:

  dlmod sunFM /usr/lib/fm/sparcv9/libfmd_snmp.so.1
  trap2sink x.x.x.x:162   [ or port 161]

Then the machinewill try to send hardware error notifications to 
x.x.x.x:162.

Does the full header of the email give any hints on which machine the 
email is coming from? If so, log into the Service Processor (SPARC) or use 
IPMI (x86) to check for hardware errors detected by the system.

IIRC, SUNWswasr is the package that is installed on the site's event 
funnel. It connects to Oracle's backend if the error is non-trivial and 
requires service. The Oracle backend then opens a ticket, if you have a 
support contract, automatically.

On some machines, the ASR notification destination is configured in the 
Service Processor. If the Network Management ethernet port is connected to 
a routed port it is also possible to have the Service Processor send email 
via SMTP to a configured IP.

On older machines, an agent had to be installed on the machine to watch 
for hardware and send notifications to the site ASR host.

-Daryl