From: Tru64 User (tru64user@yahoo.com)
Date: Fri May 16 2003 - 15:04:30 EDT
Hi,
I got two very informative replies on rdsym from HP
personnel, Dr. Thomas Blinn and Roberto Romani.
Basically both point to ::
---------------------------------------
I can see that it seems to be used to find the address
inside of the
running kernel for a given kernel symbol (hence "read
symbol" or to
be cryptic "rdsym"). It may be used as a helper
program for things
that need to do this, and it may be in the critical
path for things
like logging in, I simply don't know (and it takes
time to search
the system's sources looking for references to it).
"rdsym" wants to talk to the kernel loader service,
aka "kloadsrv",
which should have been started by init and usually is
running as
pid 3 or so from the /sbin/kloadsrv image.
If kloadsrv dies, all kinds of strange things happen.
It's not
supposed to ever just die, and if it does, I don't
think "init"
will re-spawn it, it's supposed to be started even
before init
tries to access the system console.
If "kloadsrv" isn't running, you may have to reboot to
clean up
whatever made it die. Check the console logs and the
logs in
the syslog.dated to see if you can find any error
logged, but
it's unlikely that you will find anything. You might
find a
core file in root (/).
------------------------------------
Since it is a suid program, i have a scenario of how
it could have happened. The user states that he
performed a cut and paste of big text, in error, on to
the command prompt. So "likely" it happened that way!
Otherwise, kloadsrv is still running (since march
21st, last reboot). No core file in /.
and netstat still hangs!
Any other clues welcomed, and am planning for a
shutdown over the weekend.
_Thanks
Richard
--- Tru64 User <tru64user@yahoo.com> wrote:
> Hi All,
>
> Tru64 v4.0G Patch Kit #3
>
> First we started getting
> 1. vmunix: task_create() failed for pid 5002:
> maxuprc
> (=128) exceeded for uid 6232
>
> This user was not logged in, and ps did not show
> anything running under their uid.
>
> 2. Then I found about 318 procs called rdsym running
> on system, owned by root
>
> sample:
> root 23523 1 0.0 12:04:28 ttys9
> 0:00.01 /usr/lbin/rdsym
> root 26293 1 0.0 12:04:29 ttys9
> 0:00.01 /usr/lbin/rdsym
>
> There is no manpage for rdsym, and searching into
> archives did not give me much. Not sure what
> triggered
> it, or what it does. Need a light on this.
> Killing all rdsym procs, enabled the user to log in.
> Remember, rdsym was owned by root, there were 318
> procs running (using ps -ef|grep rdsym|wc -l).
> How is that related to the user?? Mystery i am
> trying
> to solve.
>
> 3. Now, netstat hangs!! Running trace on it, spits
> out
>
> #trace netstat
> netstat
> Tracing process /proc/10466
> PIOCPSINFO: Operation would block
>
> Anybody has a quick clue of what is going on here?
> They might all be related, or not.....by simple
> uid/proc id, there is no link!
>
> All similar experience stories welcomed.
>
> _Thanks
>
> Richard
>
> =====
>
>
> __________________________________
> Do you Yahoo!?
> The New Yahoo! Search - Faster. Easier. Bingo.
> http://search.yahoo.com
=====
__________________________________
Do you Yahoo!?
The New Yahoo! Search - Faster. Easier. Bingo.
http://search.yahoo.com
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:49:19 EDT