We've been getting email from one of our Solaris 10 servers, and I can't figure out precisely where it's coming from. It's a system call "Auto Service Request" or ASR, and produces and email like this: You requested the following events be forwarded to you from wwdsvpciss2
Site : City of Winnipeg 510 Main St Agent : wwdsvpciss2 Severity : Major Category : agent Device Id : wwdsvpciss2 Topic : System Event Type : NotifierFailedEvent Event Code : 4.72.582 Event Date : 2013-09-26 03:29:30
Description: An attempt to contact the ASR server resulted in a Connection timed out failure.
Probable Cause: The ASR has indicated a problem processing the posted data. The cause may be due to an internal server failure, invalid settings locally, or due to the
Recommended Action: Examine the reason indicated in the description. If the reason indicates a server failure, then back end support will need to be notified. If the connection was refused, verify the Sun Connection Configuration settings first, then verify with back end support that the server is operational.
It seems like there is a package responsible for this called "SUNWswasr" except that's not installed on this machine! I've checked all kinds of logs and it also doesn't seem to have a trace in crontab. Magic? Please suggest some other places to look! We want to stop getting these messages or at least direct them to a different account.
Thanks, Kevin
grep -R emailaddress@thatis.getting.emails.ca /
Horrible.. and would thrash your disk.. but it would find it.
Rob
On Thu, Oct 24, 2013 at 9:55 AM, Kevin McGregor kevin.a.mcgregor@gmail.comwrote:
On Thu, 24 Oct 2013, Kevin McGregor wrote:
ASR is driven by SNMP traps. The are supposed to rendezvous at one server at your site that is connected to Oracle's backend. New machines automatically send these. Check the offending machines /etc/sma/snmp/snmpd.conf . If you see something like:
dlmod sunFM /usr/lib/fm/sparcv9/libfmd_snmp.so.1 trap2sink x.x.x.x:162 [ or port 161]
Then the machinewill try to send hardware error notifications to x.x.x.x:162.
Does the full header of the email give any hints on which machine the email is coming from? If so, log into the Service Processor (SPARC) or use IPMI (x86) to check for hardware errors detected by the system.
IIRC, SUNWswasr is the package that is installed on the site's event funnel. It connects to Oracle's backend if the error is non-trivial and requires service. The Oracle backend then opens a ticket, if you have a support contract, automatically.
On some machines, the ASR notification destination is configured in the Service Processor. If the Network Management ethernet port is connected to a routed port it is also possible to have the Service Processor send email via SMTP to a configured IP.
On older machines, an agent had to be installed on the machine to watch for hardware and send notifications to the site ASR host.
-Daryl
It seems to be the Sun StorageTek array management software (SUNWsefms). SUNWswasr isn't installed. The config files are in /var/opt/SUNWsefms/etc and /var/opt/SUNWsefms/store/Notification
I've modified the config files with vi and restarted svc:/system/fmservice. I'm getting close!
On Thu, Oct 24, 2013 at 10:17 PM, Daryl F wyatt@prairieturtle.ca wrote:
-
Daryl F -
Kevin McGregor -
Robert Keizer