[RndTbl] Obscure Solaris email?

Kevin McGregor kevin.a.mcgregor at gmail.com
Fri Oct 25 08:48:19 CDT 2013


It seems to be the Sun StorageTek array management software (SUNWsefms).
SUNWswasr isn't installed. The config files are in
/var/opt/SUNWsefms/etc
and
/var/opt/SUNWsefms/store/Notification

I've modified the config files with vi and restarted svc:/system/fmservice.
I'm getting close!


On Thu, Oct 24, 2013 at 10:17 PM, Daryl F <wyatt at prairieturtle.ca> wrote:

> On Thu, 24 Oct 2013, Kevin McGregor wrote:
>
>  We've been getting email from one of our Solaris 10 servers, and I can't
>> figure out precisely where it's coming from. It's a system call "Auto
>> Service Request" or ASR, and produces and email like this:
>> You requested the following events be forwarded to you from wwdsvpciss2
>>
>> Site       : City of Winnipeg 510 Main St
>> Agent      : wwdsvpciss2
>> Severity   : Major
>> Category   : agent
>> Device Id  : wwdsvpciss2
>> Topic      : System
>> Event Type : NotifierFailedEvent
>> Event Code : 4.72.582
>> Event Date : 2013-09-26 03:29:30
>>
>> Description:
>> An attempt to contact the ASR server resulted in a Connection timed out
>> failure.
>>
>>
>> Probable Cause:
>> The ASR has indicated a problem processing the posted data.
>> The cause may be due to an internal server failure, invalid settings
>> locally, or due to the
>>
>>
>> Recommended Action:
>> Examine the reason indicated in the description.
>> If the reason indicates a server failure, then back end support will need
>> to be notified.
>> If the connection was refused, verify the Sun Connection Configuration
>> settings first, then verify with back end support that the server is
>> operational.
>>
>>
>> It seems like there is a package responsible for this called "SUNWswasr"
>> except that's not installed on this machine! I've checked all kinds of
>> logs
>> and it also doesn't seem to have a trace in crontab. Magic? Please suggest
>> some other places to look! We want to stop getting these messages or at
>> least direct them to a different account.
>>
>> Thanks,
>> Kevin
>>
>>
> ASR is driven by SNMP traps. The are supposed to rendezvous at one server
> at your site that is connected to Oracle's backend. New machines
> automatically send these. Check the offending machines
> /etc/sma/snmp/snmpd.conf . If you see something like:
>
>  dlmod sunFM /usr/lib/fm/sparcv9/libfmd_**snmp.so.1
>  trap2sink x.x.x.x:162   [ or port 161]
>
> Then the machinewill try to send hardware error notifications to
> x.x.x.x:162.
>
> Does the full header of the email give any hints on which machine the
> email is coming from? If so, log into the Service Processor (SPARC) or use
> IPMI (x86) to check for hardware errors detected by the system.
>
> IIRC, SUNWswasr is the package that is installed on the site's event
> funnel. It connects to Oracle's backend if the error is non-trivial and
> requires service. The Oracle backend then opens a ticket, if you have a
> support contract, automatically.
>
> On some machines, the ASR notification destination is configured in the
> Service Processor. If the Network Management ethernet port is connected to
> a routed port it is also possible to have the Service Processor send email
> via SMTP to a configured IP.
>
> On older machines, an agent had to be installed on the machine to watch
> for hardware and send notifications to the site ASR host.
>
> -Daryl
>
> ______________________________**_________________
> Roundtable mailing list
> Roundtable at muug.mb.ca
> http://www.muug.mb.ca/mailman/**listinfo/roundtable<http://www.muug.mb.ca/mailman/listinfo/roundtable>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.muug.mb.ca/pipermail/roundtable/attachments/20131025/eaece162/attachment.html>


More information about the Roundtable mailing list