[RndTbl] Obscure Solaris email?

Kevin McGregor kevin.a.mcgregor at gmail.com
Fri Oct 25 08:48:19 CDT 2013

It seems to be the Sun StorageTek array management software (SUNWsefms).
SUNWswasr isn't installed. The config files are in

I've modified the config files with vi and restarted svc:/system/fmservice.
I'm getting close!

On Thu, Oct 24, 2013 at 10:17 PM, Daryl F <wyatt at prairieturtle.ca> wrote:

> On Thu, 24 Oct 2013, Kevin McGregor wrote:
>  We've been getting email from one of our Solaris 10 servers, and I can't
>> figure out precisely where it's coming from. It's a system call "Auto
>> Service Request" or ASR, and produces and email like this:
>> You requested the following events be forwarded to you from wwdsvpciss2
>> Site       : City of Winnipeg 510 Main St
>> Agent      : wwdsvpciss2
>> Severity   : Major
>> Category   : agent
>> Device Id  : wwdsvpciss2
>> Topic      : System
>> Event Type : NotifierFailedEvent
>> Event Code : 4.72.582
>> Event Date : 2013-09-26 03:29:30
>> Description:
>> An attempt to contact the ASR server resulted in a Connection timed out
>> failure.
>> Probable Cause:
>> The ASR has indicated a problem processing the posted data.
>> The cause may be due to an internal server failure, invalid settings
>> locally, or due to the
>> Recommended Action:
>> Examine the reason indicated in the description.
>> If the reason indicates a server failure, then back end support will need
>> to be notified.
>> If the connection was refused, verify the Sun Connection Configuration
>> settings first, then verify with back end support that the server is
>> operational.
>> It seems like there is a package responsible for this called "SUNWswasr"
>> except that's not installed on this machine! I've checked all kinds of
>> logs
>> and it also doesn't seem to have a trace in crontab. Magic? Please suggest
>> some other places to look! We want to stop getting these messages or at
>> least direct them to a different account.
>> Thanks,
>> Kevin
> ASR is driven by SNMP traps. The are supposed to rendezvous at one server
> at your site that is connected to Oracle's backend. New machines
> automatically send these. Check the offending machines
> /etc/sma/snmp/snmpd.conf . If you see something like:
>  dlmod sunFM /usr/lib/fm/sparcv9/libfmd_**snmp.so.1
>  trap2sink x.x.x.x:162   [ or port 161]
> Then the machinewill try to send hardware error notifications to
> x.x.x.x:162.
> Does the full header of the email give any hints on which machine the
> email is coming from? If so, log into the Service Processor (SPARC) or use
> IPMI (x86) to check for hardware errors detected by the system.
> IIRC, SUNWswasr is the package that is installed on the site's event
> funnel. It connects to Oracle's backend if the error is non-trivial and
> requires service. The Oracle backend then opens a ticket, if you have a
> support contract, automatically.
> On some machines, the ASR notification destination is configured in the
> Service Processor. If the Network Management ethernet port is connected to
> a routed port it is also possible to have the Service Processor send email
> via SMTP to a configured IP.
> On older machines, an agent had to be installed on the machine to watch
> for hardware and send notifications to the site ASR host.
> -Daryl
> ______________________________**_________________
> Roundtable mailing list
> Roundtable at muug.mb.ca
> http://www.muug.mb.ca/mailman/**listinfo/roundtable<http://www.muug.mb.ca/mailman/listinfo/roundtable>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.muug.mb.ca/pipermail/roundtable/attachments/20131025/eaece162/attachment.html>

More information about the Roundtable mailing list