On Thu, 24 Oct 2013, Kevin McGregor wrote:

We've been getting email from one of our Solaris 10 servers, and I can't
figure out precisely where it's coming from. It's a system call "Auto
Service Request" or ASR, and produces and email like this:
You requested the following events be forwarded to you from wwdsvpciss2

Site       : City of Winnipeg 510 Main St
Agent      : wwdsvpciss2
Severity   : Major
Category   : agent
Device Id  : wwdsvpciss2
Topic      : System
Event Type : NotifierFailedEvent
Event Code : 4.72.582
Event Date : 2013-09-26 03:29:30

Description:
An attempt to contact the ASR server resulted in a Connection timed out
failure.


Probable Cause:
The ASR has indicated a problem processing the posted data.
The cause may be due to an internal server failure, invalid settings
locally, or due to the


Recommended Action:
Examine the reason indicated in the description.
If the reason indicates a server failure, then back end support will need
to be notified.
If the connection was refused, verify the Sun Connection Configuration
settings first, then verify with back end support that the server is
operational.


It seems like there is a package responsible for this called "SUNWswasr"
except that's not installed on this machine! I've checked all kinds of logs
and it also doesn't seem to have a trace in crontab. Magic? Please suggest
some other places to look! We want to stop getting these messages or at
least direct them to a different account.

Thanks,
Kevin

ASR is driven by SNMP traps. The are supposed to rendezvous at one server at your site that is connected to Oracle's backend. New machines automatically send these. Check the offending machines /etc/sma/snmp/snmpd.conf . If you see something like:

 dlmod sunFM /usr/lib/fm/sparcv9/libfmd_snmp.so.1
 trap2sink x.x.x.x:162   [ or port 161]

Then the machinewill try to send hardware error notifications to x.x.x.x:162.

Does the full header of the email give any hints on which machine the email is coming from? If so, log into the Service Processor (SPARC) or use IPMI (x86) to check for hardware errors detected by the system.

IIRC, SUNWswasr is the package that is installed on the site's event funnel. It connects to Oracle's backend if the error is non-trivial and requires service. The Oracle backend then opens a ticket, if you have a support contract, automatically.

On some machines, the ASR notification destination is configured in the Service Processor. If the Network Management ethernet port is connected to a routed port it is also possible to have the Service Processor send email via SMTP to a configured IP.

On older machines, an agent had to be installed on the machine to watch for hardware and send notifications to the site ASR host.

-Daryl

_______________________________________________
Roundtable mailing list
Roundtable@muug.mb.ca
http://www.muug.mb.ca/mailman/listinfo/roundtable