Aix 6.1 + PowerVM + Hdlm + Gpfs + Oracle Clusterware + Grid Control + Rac 11gr2 + AMS2100

HP/UX system administration

2012-02-22T11:51:00.000-03:00

HP/UX system administration

Basic usage

Check system version, release and patches,

uname -r

swlist -l bundle | grep ' OS'

swlist -l bundle | grep ' Operating Environment'

swlist -a state -a patch_state PH*

Note. B.11.11 = 11i

Note. B.11.23 = 11i v2

Note. B.11.31 = 11i v3

Check for CPUs,

ioscan -fnkC processor

top

Check for memory and swap,

swapinfo -a

dmesg | more  # search for Memory

top    # real + virtual + free

Check for disks,

ioscan -fnkC disk

Check for filesystems,

cat /etc/mnttab

bdf

Add some user and fix its shell,

useradd -m user1

passwd user1

chsh user1 /usr/local/bin/bash

If you desperately need more space,

fsadm -b 1048576 /var

fsadm -b 4194304 /usr

fsadm -b 5242880 /opt

lvreduce -L 1024 /dev/vg00/lvol8

lvreduce -L 4096 /dev/vg00/lvol7

lvreduce -L 5120 /dev/vg00/lvol6

Note. if you also want to resize /stand, you may try with "-C y" and "lvlnboot -r" thereafter.

Package management

View some product content,

swlist -l product | grep -i cde

swlist -l fileset CDE

swlist -l file CDE.CDE-MIN

Install products,

gunzip mutt-1.5.20-ia64-11.23.depot.gz

unset DISPLAY

swlist -s /root/mutt-1.5.20-ia64-11.23.depot

swinstall -s /root/mutt-1.5.20-ia64-11.23.depot mutt

If you experience errors, check the logs,

cd /var/adm/sw/queue/logfiles

cd 000X

more logfile

remove the failed software install,

swremove BUNDLE

and try again, once you fixed the issue,

swinstall /absolute/path/to/BUNDLE

HBA configuration & multipathing

Display hard drives & LUNs,

ioscan -fnC disk

Note. "-funC" for "usable" disks

Note. "insf" or "insf -e -C disk" to force device creation

Note. "-k" as user

Display Fiber Channel adapters,

ioscan -fnC fc

display the HBA's WWN,

fcmsutil /dev/fcd0

note. "/dev/fcdX" or "/dev/tdX"

check for LUNs,

ioscan -fnC disk

For HP/UX 11.23

Configure PVLink (11.23 - Path failover through LVM). Once your VG is working on one path (PV needs to be created on one of the paths first, see the "LVM configuration" paragraph), add the alternate paths to it,

vgextend vg01 /dev/dsk/c2t0d1 /dev/dsk/c6t0d1 /dev/dsk/c8t0d1

Note. otherwise purchase and use SecurePath

For HP/UX 11.31

SAN Multipath option comes with OS. The new storage stack includes dynamic multipath balancing.

Backup/restore

To recover files to original location,

frecover -f /dev/rmt/0m -xov -i /source_directory

To recover files relative to the current working directory:

cd /destination_directory

frecover -f /dev/rmt/0m -xXov -i /source_directory

Refs.

forums11.itrc.hp.com/service/forums/questionanswer.do?threadId=2801&admit=109447626+1253637912723+28353475

docs.hp.com/en/B2355-90672/ch09s08.html

docs.hp.com/en/B2355-90950/ch06s04.html

Single user mode

Interrupt the bootloader timeout and boot single user,

boot -is vmunix

Define PATH, TERM and proceed...,

PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin

TERM=vt100

export PATH TERM

...

Note. if you have bash installed,

/usr/local/bin/bash

Note. if you need to use LVM,

vgchange -a y VGNAME

Note. switch to init 3,

sync

init 3

Misc

Get a decent environment with the default shell and vars,

stty erase ^?

export TERM=xterm

Check the logs,

tail -f /var/adm/syslog/syslog.log

tail -f /var/adm/syslog/mail.log

Shutdown,

cd /

shutdown -h -y now

reboot,

cd /

shutdown -r -y now

#reboot

To give an alternate default shell for all normal users,

vi /etc/profile

add,

if [ $LOGNAME != root \

-a $LOGNAME != daemon \

-a $LOGNAME != bin \

-a $LOGNAME != sys \

... ]; then

command

fi

To add the rc.local feature to HP/UX,

cd /sbin

vi rc

add at the end,

/bin/ksh /etc/rc.local

then your rc.local script,

cd /etc

vi rc.local

like e.g.,

#!/bin/ksh

PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin:$HOME/bin\

:/usr/local/apache2/bin:/usr/local/mysql/bin

export PATH

print "starting mysqld"

mysqld_safe --user=mysql &

print "starting apache2"

apachectl start

fix perms,

chmod 755 rc.local

Instead of "diff -r", use,

dircmp -s -d folder1 folder2 2>&1 | more

Note. this only works directory per directory.

Check if only space & tabs:

od -c file

Free the 80 port,

cd /opt/DevMan

vi DevManBE.ini

changer,

[Service]

AutoStart=1

Fresh Install=0

[Web]

Port=8081

apply,

cd /sbin/rc3.d

./DevMan stop

./DevMan start

To mount an ISO image on HP/UX 11.31 (11iv3),

lvcreate -n cdrom -L 5000 vg00

cd /var/tmp

dd if=image.iso of=/dev/vg00/rcdrom bs=4096k

  mkdir -p /cdrom

mount /dev/vg00/cdrom /cdrom

Note. lvcreate -L in MB

Note. dd against the raw device (rcdx)

To mount an ISO (w/ or w/o rockridge) on older HP/UX releases,

/usr/sbin/pfs_mountd &

/usr/sbin/pfsd &

then edit or create this file,

vi /etc/pfs_fstab

with the following contents:

/dev/dsk/c0t4d0 /ISO_CDROM pfs-iso9660 xlat=unix 0 0

/dev/dsk/c0t4d0 /ISO_RR_CDROM pfs-rrip xlat=unix 0 0

note. create the dirs,

mkdir /ISO_CDROM

mkdir /ISO_RR_CDROM

mount the CDrom,

pfs_mount /ISO_CDROM

ls -l /ISO_CDROM

umount the CDrom,

pfs_umount /ISO_CDROM

same with long filenames

pfs_mount /ISO_RR_CDROM

pfs_umount /ISO_RR_CDROM

Refs.

sysunconfig.net/unixtips/hp_cdrom.txt

forums11.itrc.hp.com/service/forums/questionanswer.do?admit=109447626+1221656305536+28353475&threadId=1060487

forums12.itrc.hp.com/service/forums/questionanswer.do?admit=109447627+1221655722783+28353475&threadId=1153978

Software references

Software Depot home : software.hp.com/

IT Resource Center : itrc.hp.com/

Porting And Archive Centre : hpux.connect.org.uk/

Index of /gcc : hpacxx.external.hp.com/gcc/

References

HP documentation portal : docs.hp.com/

HP IT ressources : www.itrc.hp.com/

HP support : support.hp.com/

www.docs.hp.com/en/B2355-90950/ch05s01.html

www.unixhub.com/docs/hpux/hpux_boot.html

HP/UX 11i v2 documentation : docs.hp.com/fr/hpux11iv2.html

Manual pages : docs.hp.com/en/hpuxman_pages.html

Versus Solaris : www.loudermilk.org/software/solaris-hpux.html#goodstuff

Security : www.blacksheepnetworks.com/security/resources/sec_HPUX2.html

vPar : christianbilien.wordpress.com/2007/03/25/vpar-memory-granule-size-matters/

HP-UX: Disk and Filesystem tasks : www.unixguide.net/hp/hplvmtasks.shtml

Security references

Great guide : www.darklab.net/resources/hp-ux11.html

Quick view : dataprotected.files.wordpress.com/2008/05/hp-ux-security-check.pdf

Ncops : mayoxide.com/ncops/

NPIV Setup and Configuration to Virtualize Fibre-channel card on IBM p6

2012-02-17T11:50:00.000-03:00

With N_Port ID Virtualization (NPIV), you can configure the managed system so that multiple logical partitions can access independent physical storage through the same physical fibre channel adapter.
To access physical storage in a typical storage area network (SAN) that uses fibre channel, the physical storage is mapped to logical units (LUNs) and the LUNs are mapped to the ports of physical fibre channel adapters. Each physical port on each physical fibre channel adapter is identified using one worldwide port name (WWPN).
NPIV is a standard technology for fibre channel networks that enables you to connect multiple logical partitions to one physical port of a physical fibre channel adapter. Each logical partition is identified by a unique WWPN, which means that you can connect each logical partition to independent physical storage on a SAN.
The figure below illustrates a managed system configured to use NPIV :-

Requirements

You can configure virtual fibre channel adapters on client logical partitions that run the following operating systems:

• AIX® version 6.1 Technology Level 2, or later

• AIX 5.3 Technology Level 9

• SUSE Linux® Enterprise Server 11, or later

1. Basic requirements.

2. Benefits

3. Disadvantage if any....

1. Basic Requirements will contain:

• Advance Power Vitalization License (VET Code)

• 8 Gb fibre card.

• NPIV supported san switch.

• VIO version as 2.1.0 with SP20 and above, it is recommended please updates the VIOS version to latest level.

• AIX version 5300-10 and above, Aix 6.1 6100-02-02-0849.

• Power 6 hardware

• System Firmware version to be 01E#340_075 and above ( where # = L,M,H = Low , Middle , High )

• HMC V7 R3.4.0 and System firmware 340-039

2. Benefits:

• Using NPIV we can assign the LUN's from the storage directly to the VIO client’s. Due to this no mapping will be required to be done from the VIO server.

• Usefully when customer is using cluster environment's (HACMP, GPFS).

• Unique WWN is generated for each virtual of fiber card.

• No additional device driver's filesets needs to be installed on VIO server.

3. Disadvantages:

• NPIV support san switch is mandatory.

• 8Gb fiber card can only be virtual

• Advance VET license required which leds to additional costs.

• Virtual of fiber tape drive is yet not supported.

Configuring Virtual fibre channel for HMC-Managed systems

This section describes the steps to create a virtual fibre channel adapter on a p6 LPAR

Creating a VFC host adapter on the VIO Server

• Select the VIOS and edit the profile

• Go to the “Virtual Adapters” Tab

o Select ‘Actions > Create > Fibre Channel Adapter’

• The type of adapter is “Server” since this is being created on the VIOS.

• Put a ‘check’ in the box if the adapter is required at the time of partition activation.

o You would need this box marked if you are using the adapter for SAN boot. I would recommend always checking it.

• Select the client partition you want this Server adapter to be associated with.

• Take a note of the assigned Server Adapter ID (13) and the Client Adapter ID (2). You will need to know this information when you create the client adapter.

o If the VIO server is already active you will not be able to modify the adapter ID info in the profile once it has been created. Because of this you will need to first check the client for available virtual adapter ID's then when you create the VIO server adapter specify that available ID for the client adapter ID.

• Select ‘OK’ to create

You now have a Virtual Fibre Channel (VFC) host adapter created. The next step is to go to you client partition and create a Virtual Fibre Channel client adapter which will be associated with the VFC host adapter.

Creating a VFC client adapter on the VIO Client

• From the Client Partition that you selected to use when creating the VFC host adapter in the previous steps, go to the “Virtual Adapters” tab then select ‘Actions > Create > Fibre Channel Adapter..

• You will see that the next available Virtual Adapter ID on the the client is “3”.

o When we created the VFC host adapter the value was set to “2” for the client adapter ID.

So you will have to go back and change the VFC host adapter after the VFC client
adapter has been created so the client ID matches.

• Put a ‘check’ in the box if the adapter is required at the time of partition activation.

o You would need this box marked if you are using the adapter for SAN boot. I would recommend always checking it.

• Select the Server partition which has the VFC host adapter that this VFC client adapter will be associated with.

• Change the Server Adapter ID to match the Server Adapter ID that you took note of when creating the VFC host adapter. In this case it was “13”.

• Select “OK” to create

Linking the VFC host and VFC client adapters

• Now back on the VIO Server Partition, Edit the profile and go back to the “Virtual Adapters” tab, select ‘Actions > Edit > Fibre Channel Adapter..

• You will see that the Client Adapter ID is set to “2”. We need to change this to match the adapter

ID that was assigned when creating the Client Adapter which was “3”.

• Type in the Actual Client Adapter ID and Select “OK” to complete the change.

Virtual Fibre Channel Adapter Verification

In the image below is what you should see from both the VIO Server and the Client Partition Profiles.
You see the Server has a “Server Fibre Channel Adapter with and ID of “13”, Connecting Partition of
“megatron01, and Connecting Adapter of “3”
Then from the Client you will see the Client has a “Client Fibre Channel Adapter” with an ID of “3”, a
Connecting Partition of “megatronv1”, and a Connecting Adapter of “13”.

• VIO Server:

• VIO Client:

Creating VFC client adapter on the IVM Client

NOTE: For IVM systems you do not need to create the server adapter and link the server and client adapters yourself. The IVM interface takes care of these two steps for you when you create the client adapter

• Open the client properties window. Remember there is no profile for IVM partitions. Click on the

"Storage" tab. Find and expand the "Virtual Fibre Channel" section.

• If there is not already an entry showing "Automatically generate" under the WWPN column, click on "Add"

• Select the new entry, and under the "Physical Port" column select the physical adapter, click ok

• After the adapter has been created, you should see the new WWPNs under the "Worldwide Port

Names" column

• To verify connections and look up client WWPNs, click on the "View Virtual Fibre Channel" option from the main menu

• You can see each physical adapter and their connections. Select the adapter and click on "View

Partition Connections" to bring up the list of client connections and their WWPNs

Mapping the VFC Host Adapter to Physical FC Port

In the previous steps we created the virtual fibre channel adapters however they are not yet associated with any physical fibre channel adapter / port. So the next step is to associate the VFC host adapter on the VIO
Server with a physical fibre channel adapter port enabling the vfc host adapter to log into the SAN.

• Verify the VFC adapters are “Available” on the VIOS

$ ioscli lsdev -dev vfchost*
name status description
vfchost0 Available Virtual FC Server Adapter

• Show current VFC mappings to physical (In this example the vfchost has no mappings as indicated by the “NONE”)

$ ioscli lsdev -dev vfchost0 -attr map_port NONE N/A True

• Display the physical fibre channel adapters (You will decide which adapter / port to use based on how you setup you switch zoning and Storage allocation plan)

$ ioscli lsdev -dev fcs*
name status description
fcs0 Available 8Gb PCI Express Dual Port FC Adapter (df1000f114108a03)
fcs1 Available 8Gb PCI Express Dual Port FC Adapter (df1000f114108a03)

• Map the virtual fibre channel adapter to the physical fibre channel adapter on the VIOS

$ ioscli vfcmap -vadapter “VFCServerAdapter” -fcp “FCPName” Example: ioscli vfcmap –vadapter vfchost0 –fcp fcs0

• Show the VFC mapping to the physical fibre channel adapter ioscli lsdev -dev vfchost0 –attr

map_port fcs0 N/A True

WWPN, Allocations and Zoning Info

When you do your storage allocations you will be allocating the storage directly to the WWPN of the VFC
client adapter.
If you are attempting to SAN boot, or do Storage allocations prior to the VIO client partition is activated you can display the VFC client adapter WWPN via the HMC with the following steps.

• Go to the Client Partition profile and select edit > Select the Virtual Adapters Tab > Highlight the

VFC adapter > Select ‘Actions’ > Properties
As shown in the picture below, each VFC client adapter will have 2 WWPN’s. When allocating storage you should use the first WWPN in the list. The second WWPN is to be used when performing Partition Migrations (discussed later in this doc).

If the VIO client is booted run the following command to display the active WWPN for the VFC client adapter:
$ lscfg –vl fcsX <-- where X is the adapter number
Network Address.............C05076002A7D0000

Grow your rootvg on the fly (from 6.1 TL 4)

2012-02-16T15:09:00.000-03:00

AnthonyEnglish | Oct 10 2010 | Tags: volume_group resize 7.1 6.1 rootvg spare extendlv aix 5.3 growth chvg backend disk san lun | Comments (11) | Visits (5,535)

There are lots of good reasons for having spare disk for rootvg, as I looked at in the post make way for rootvg. With virtual disks you can resize your volume group on the fly:

Increase rootvg dynamically

If your rootvg “disk” is actually virtual, such as a SAN LUN or a logical volume on the VIO server, then it usually can be expanded on the SAN (or using extendlv on the VIOS) and then recognised on the AIX LPAR using the -g flag of the chvg command:

chvg -g rootvg

Note: this is supported for rootvg and concurrent vgs from AIX 6.1 TL 4. See IBM technote IZ80021 http://bit.ly/cmHjmy

Resizing the rootvg disk

I tried to increase rootvg on an LPAR running AIX 5.3 TL 11 and hit the following error:

aix53_lpar # chvg -g rootvg

0516-1380 chvg: Re-sizing of the disks is not supported for the rootvg.

0516-732 chvg: Unable to change volume group rootvg.

Looks like the volume group needed to be varied off and varied on again. For rootvg, that means a reboot.

No reboot on AIX 6.1

In AIX 6.1 (from TL 4 - use oslevel -s to check your AIX level), you can increase rootvg on the fly.

aix61_lpar:/# chvg -g rootvg

0516-1164 chvg: Volume group rootvg changed. With given characteristics rootvg can include up to 16 physical volumes with 2032 physical partitions each.

Sounds like yet another reason to migrate to AIX 6.1.

HMC GUI Access to VIOS command

2012-02-16T11:22:00.002-03:00

How can I mount an ISO image file?

2012-02-16T10:16:00.002-03:00

With AIX 6.1 TL4 or newer you can use loopmount:

# ls -l *.iso
-rw-r--r--    1 root     system     43974656 Jan 13 17:05 dvd_aix_profilemanager.iso
# loopmount -i dvd_aix_profilemanager.iso -o "-V cdrfs -o ro" -m /mnt
# df /mnt
Filesystem    512-blocks      Free %Used    Iused %Iused Mounted on
/dev/loop0         84812         0  100%    21203   100% /mnt

How can I list filesets and versions on installation media?

2012-02-16T09:44:00.001-03:00

I want to know what filesets are present on installation media or a on a directory where I put some files with not human readable names (such as `U838402.bff`). How can I get the information?

# cd /path/to/bffs
# installp -l -d .
  Fileset Name                Level                     I/U Q Content
  ====================================================================
  Java5.samples               5.0.0.275                  I  N usr
#   Java SDK 32-bit Samples

  Java5.sdk                   5.0.0.325                  I  N usr,root
#   Java SDK 32-bit

  Java5.source                5.0.0.325                  I  N usr
#   Java SDK 32-bit Source

  Java5_64.sdk                5.0.0.325                  I  N usr,root
#   Java SDK 64-bit

  Java6.sdk                   6.0.0.215                  I  N usr,root
#   Java SDK 32-bit

The same way you can display the package name of a single fileset:

# installp -l -d U839870.bff
  Fileset Name                Level                     I/U Q Content
  ====================================================================
  devices.chrp.base.ServiceRM 1.5.0.1                    S  N usr,root
#   RSCT Service Resource Manager

Please note: Using installp requires a .toc file to be present. This is always the case on official media. However, if you downloaded some update filesets the .toc file might be missing. Not a problem - just create it with the inutoc command:

# cd /path/to/bffs
# inutoc .

How can I create a backup ethernet adapter?

2012-02-16T09:40:00.000-03:00

You have to create an etherchannel device. First you have to unconfigure the current ethernet settings on the physical ethernet adapter (`en0` in the below example). You also need to make sure that there is a second physical ethernet adapter available (`en1` in the below example). If these requirements are met you create the etherchannel with the commands below:

 # ifconfig en0 detach
 # chdev -P -l en0 -a state=down
 # mkdev -c adapter -s pseudo -t ibm_ech -a adapter_names=ent0 \
     -a backup_adapter=ent1 -a netaddr=192.168.100.1 \
     -a num_retries=3 -a retry_time=3
 # mkdev -c if -s EN -t en -a netaddr=192.168.100.33 \
     -a netmask=255.255.255.0 -w en2 -a state=up -a arp=on
 # mkdev -l inet0

The IP address of the first mkdev call belongs to a host (e.g. the gateway) that can be pinged. The system uses this to figure out if the primary network adapter is still alive. The second mkdev however, defines the IP address you want to set to your new etherchannel logical device (i.e. the communication IP address of the box). The system uses the next free number for the etherchannel device (in our example en2).

How can I see the allocated resources of an LPAR w/o checking on the HMC?

2012-02-16T09:37:00.000-03:00

Run this command on your LPAR:

 $ lparstat -i
 Node Name                                  : barney
 Partition Name                             : mylpar2
 Partition Number                           : 2
 Type                                       : Shared-SMT
 Mode                                       : Uncapped
 Entitled Capacity                          : 0.60
 Partition Group-ID                         : 32796
 Shared Pool ID                             : 0
 Online Virtual CPUs                        : 6
 Maximum Virtual CPUs                       : 10
 Minimum Virtual CPUs                       : 1
 Online Memory                              : 3072 MB
 Maximum Memory                             : 16384 MB
 Minimum Memory                             : 1024 MB
 Variable Capacity Weight                   : 80
 Minimum Capacity                           : 0.10
 Maximum Capacity                           : 10.00
 Capacity Increment                         : 0.01
 Maximum Physical CPUs in system            : 16
 Active Physical CPUs in system             : 8
 Active CPUs in Pool                        : 8
 Unallocated Capacity                       : 0.00
 Physical CPU Percentage                    : 10.00%
 Unallocated Weight                         : 0

How can I figure out the managing HMC (and CSM server) of my LPAR?

2012-02-16T09:35:00.000-03:00

To find the managing servers of your LPAR you can use the domain status information - the `ctrmc` subsystem must be active in order to do so. You can check with:

 # lssrc  -s ctrmc
 Subsystem         Group            PID          Status
  ctrmc            rsct             1151036      active

Is the subsystem indeed active you get the IP address of your HMC with:

 # /usr/sbin/rsct/bin/rmcdomainstatus -s ctrmc

 Management Domain Status: Management Control Points
   O A  0xccdfc3e608ad7624  0001  192.168.100.10

Is your LPAR also connected to a CSM server you would see two Control Points:

 # /usr/sbin/rsct/bin/rmcdomainstatus -s ctrmc

 Management Domain Status: Management Control Points
   I A  0x58016857defc1b87  0001  192.168.100.11  
   I A  0xccdfc3e608ad7624  0002  192.168.100.10

For newer versions of rsct you could also use lsrsrc to get this information:

 # lsrsrc -l "IBM.ManagementServer"
Resource Persistent Attributes for IBM.ManagementServer
resource 1:
        Name             = "192.168.100.10"
        Hostname         = "192.168.100.10"
        ManagerType      = "HMC"
        LocalHostname    = "192.168.100.23"
        ClusterTM        = "9078-160"
        ClusterSNum      = ""
        ActivePeerDomain = ""
        NodeNameList     = {"mylpar22-ext"}
resource 2:
        Name             = "192.168.100.11"
        Hostname         = "192.168.100.11"
        ManagerType      = "CSM"
        LocalHostname    = "mylpar22"
        ClusterTM        = "9078-160"
        ClusterSNum      = "10BF571"
        ActivePeerDomain = ""
        NodeNameList     = {"mylpar22-ext"}

How can I archive a directory with backup?

2012-02-16T09:30:00.002-03:00

tar on AIX has severe limitations. If I want to archive an directory without these limitations I think about the backup command. But what would be the syntax?

Assuming you want to backup /usr/local the tar command would be something like this:

# tar cvpf /tmp/archive.tar ./usr/local/

You could use the following backup command instead:

 # find ./usr/local/ | backup -iqvpf /tmp/archive.bff

To restore the backup you can use the restore command:

 # restore -xqvf /tmp/archive.bff

(the corresponding tar command would be tar xvpf /tmp/archive.tar)

VULNERABILITY: Vulnerability in AIX TCP stack

2012-02-09T08:47:00.003-03:00

IBM SECURITY ADVISORY

First Issued: Fri Feb 3 10:20:44 CST 2012

The most recent version of this document is available here:

http://aix.software.ibm.com/aix/efixes/security/large_send_advisory.asc
===============================================================================
VULNERABILITY SUMMARY

VULNERABILITY: Vulnerability in AIX TCP stack

PLATFORMS: AIX 5.3, 6.1, and 7.1 releases

SOLUTION: Apply the fix as described below.

THREAT: TCP network packet denial of service

CVE Number: CVE-2012-0194

Reboot required? YES
Workarounds? YES
Protected by FPM? NO
Protected by SED? NO
===============================================================================
DETAILED INFORMATION

I. DESCRIPTION

AIX could allow a remote attacker to cause a denial of service, caused
by an error when the TCP large send offload option is enabled on a
network interface. By sending a specially-crafted sequence of packets,
an attacker could exploit this vulnerability to cause a kernel panic.

II. CVSS

CVSS Base Score: 7.1
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/72562 for the
current score
CVSS Environmental Score*: Undefined
CVSS String: (AV:n/AC:m/Au:n/C:n/I:n/A:c)

III. PLATFORM VULNERABILITY ASSESSMENT

To determine if your system is vulnerable, execute the following
command:

lslpp -L bos.net.tcp.client

The following fileset levels are vulnerable:

AIX Fileset Lower Level Upper Level
------------------------------------------------
bos.net.tcp.client 5.3.12.0 5.3.12.5
bos.net.tcp.client 6.1.5.0 6.1.5.8
bos.net.tcp.client 6.1.6.0 6.1.6.17
bos.net.tcp.client 6.1.7.0 6.1.7.3
bos.net.tcp.client 7.1.0.0 7.1.0.17
bos.net.tcp.client 7.1.1.0 7.1.1.3

IV. SOLUTIONS

A. APARS

IBM has assigned the following APARs to this problem:

AIX Level APAR number Availability
---------------------------------------------------
5.3.12 IV13827 TBD sp6
6.1.5 IV13751 TBD sp9
6.1.6 IV13820 TBD sp8
6.1.7 IV14209 TBD sp4
7.1.0 IV14210 TBD sp5
7.1.1 IV14211 TBD sp4

Subscribe to the APARs here:

http://www.ibm.com/support/docview.wss?uid=isg1IV13827
http://www.ibm.com/support/docview.wss?uid=isg1IV13751
http://www.ibm.com/support/docview.wss?uid=isg1IV13820
http://www.ibm.com/support/docview.wss?uid=isg1IV14209
http://www.ibm.com/support/docview.wss?uid=isg1IV14210
http://www.ibm.com/support/docview.wss?uid=isg1IV14211

By subscribing, you will receive periodic email alerting you
to the status of the APAR, and a link to download the fix once
it becomes available.

B. FIXES

Fixes are available. The fixes can be downloaded via ftp
from:

ftp://aix.software.ibm.com/aix/efixes/security/large_send_fix.tar

The link above is to a tar file containing this signed
advisory, fix packages, and PGP signatures for each package.
The fixes below include prerequisite checking. This will
enforce the correct mapping between the fixes and AIX
Technology Levels.

AIX Level Interim Fix (*.Z)
-------------------------------------------------------------------
5.3.12.5 53XSP5_IV13827s05.120126.epkg.Z
6.1.5.7 61JSP7_IV13751s07.120126.epkg.Z
6.1.6.16 61NSP6_IV13820s06.120126.epkg.Z
6.1.7.2 61QS02_IV14209s02.120126.epkg.Z
7.1.0.17 71BSP4_IV14210s04.120129.epkg.Z
7.1.1.02 71DSP2_IV14211s02.120126.epkg.Z

To extract the fixes from the tar file:

tar xvf large_send_fix.tar
cd large_send_fix

Verify you have retrieved the fixes intact:

The checksums below were generated using the
"csum -h SHA1" (sha1sum) command is the followng:

csum -h SHA1 (sha1sum) filename
------------------------------------------------------------------
788096451a8e621a04bf8967b9c55cbe18fe334a
53XSP5_IV13827s05.120126.epkg.Z
37aca7ad354a8e0775152f6801c0d9790a990782
61JSP7_IV13751s07.120126.epkg.Z
637048a0ab3764d712a837815cccf355bf4be245
61NSP6_IV13820s06.120126.epkg.Z
12fddcb7e3ee87144a8ed8008c4e40ea70df8262
61QS02_IV14209s02.120126.epkg.Z
246e09b69f741a1c552042c065bfc0854167c5f3
71BSP4_IV14210s04.120129.epkg.Z
5945422d284849fd2f268a5b54a62eeb2fcae18b
71DSP2_IV14211s02.120126.epkg.Z

To verify the sum, use the text of this advisory as input to sha1sum.
For example:

csum -h SHA1 -i Advisory.asc
sha1sum -c Advisory.asc

These sums should match exactly. The PGP signatures in the tar
file and on this advisory can also be used to verify the
integrity of the fixes. If the sums or signatures cannot be
confirmed, contact IBM AIX Security at
security-alert@austin.ibm.com and describe the discrepancy.

C. FIX AND INTERIM FIX INSTALLATION

IMPORTANT: If possible, it is recommended that a mksysb backup
of the system be created. Verify it is both bootable and
readable before proceeding.

To preview a fix installation:

installp -a -d fix_name -p all # where fix_name is the name of the
# fix package being previewed.
To install a fix package:

installp -a -d fix_name -X all # where fix_name is the name of the
# fix package being installed.

Interim fixes have had limited functional and regression
testing but not the full regression testing that takes place
for Service Packs; thus, IBM does not warrant the fully
correct functionality of an interim fix.

Interim fix management documentation can be found at:

http://www14.software.ibm.com/webapp/set2/sas/f/aix.efixmgmt/home.html

To preview an interim fix installation:

emgr -e ipkg_name -p # where ipkg_name is the name of the
# interim fix package being previewed.

To install an interim fix package:

emgr -e ipkg_name -X # where ipkg_name is the name of the
# interim fix package being installed.

V. WORKAROUNDS

Adjust the lowest value from the common path MTUs table based on
customer configuration.
Turn off large send function (may have performance impact)
Turn off path MTU discovery (may have performance impact)

VI. OBTAINING FIXES

AIX security fixes can be downloaded from:

ftp://aix.software.ibm.com/aix/efixes/security

AIX fixes can be downloaded from:

http://www.ibm.com/eserver/support/fixes/fixcentral/main/pseries/aix

NOTE: Affected customers are urged to upgrade to the latest
applicable Technology Level and Service Pack.

VII. CONTACT INFORMATION

If you would like to receive AIX Security Advisories via email,
please visit:

http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd

Comments regarding the content of this announcement can be
directed to:

security-alert@austin.ibm.com

To request the PGP public key that can be used to communicate
securely with the AIX Security Team you can either:

A. Send an email with "get key" in the subject line to:

security-alert@austin.ibm.com

B. Download the key from a PGP Public Key Server. The key ID is:

0x28BFAA12

Please contact your local IBM AIX support center for any
assistance.

eServer is a trademark of International Business Machines
Corporation. IBM, AIX and pSeries are registered trademarks of
International Business Machines Corporation. All other trademarks
are property of their respective holders.

VIII. REFERENCES:

Complete CVSS Guide: http://www.first.org/cvss/cvss-guide.html
On-line Calculator V2:
http://nvd.nist.gov/cvss.cfm?calculator&adv&version=2
X-Force Vulnerability Database: http://xforce.iss.net/xforce/xfdb/72562
CVE-2012-0194: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0194

*The CVSS Environment Score is customer environment specific and will
ultimately impact the Overall CVSS Score. Customers can evaluate the
impact of this vulnerability in their environments by accessing the links
in the Reference section of this Flash.

Note: According to the Forum of Incident Response and Security Teams
(FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry
open standard designed to convey vulnerability severity and help to
determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES
"AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE
RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY
VULNERABILITY.

Problems in previous version to GPFS 3.4.0.7

2012-01-10T15:38:00.001-03:00

Problems fixed in GPFS 3.4.0.7 [July 29, 2011]

Reference any user handle passed to the kernel using the correct access mode and security check.
Fix code which can lead to assertion in a very rare case.
Sovled rare race condition which may lead to a kernel crash for 64bit AIX boxes when starting GPFS and unloading GPFS kernel extension concurrently.
Fix deadlock involving fcntl locking operations that can occur on on Linux systems with 2.6.18 based kernels under memory pressure.
Fix a problem in libmmantras that was causing application core dump.
Fixed a problem found when reading alloc sum file.
Fixed mmexpelnode to avoid 'Failed to locate a working cluster manager' errors.
Fixed bad assertion in InodeLkObj::token_revoke.
Fixed remount code that caused mmmount to still show success after remount failed.
Fix for a rare race condition when GPFS startup and shutdown race each other, resulting in a spurious assert.
Fix to allow policy rules files with extremely long files, such as those that may be generated by a program or a script. A viable workaround would be to just insert a few newline characters to break long lines.
Command mmlsquota with option -d only allows one option among -u, -g, -j.
Fix 'unknown opcode 0x20' warning message in trace back of linux on x86_64.
Add protection to filesystem name in preUnmount event callback to prevent kernel panic.
Call putECred on exit from kxWinOps and kxSetTimes.
Fix to possible deadlock situation after a node which is the primaryNSD server fails while I/O requests are being handled by that NSD server. Threads may be waiting for "Change SG desc".
Correct disk usage problem in recent Linux kernels with certain LANG setting.
Fix long waiters caused by error handling in mmpmonNodeListRequest message handler.
Serialize creation of grace period thread.
Fix log code which can cause filesystem cleanup to get stuck, which could then prevent other GPFS commands from executing.
Remove extra IOs when closing a sequentially written file that is larger than the writebehindThreshold.
Fix rare kernel memory race condition doing AIX IO when the disk max_transfer setting is smaller than the GPFS blocksize.
Address an issue of mmrestoreconfig in mix version cluster.
Added new api to restripe a very big file in chunks.
Fix GPFS RDMA ibv_reg_mr error 12.
Fix segfault in tsapolicy due to destructor being called twice.
Fix code that can cause mmdefragfs to never finish. This could occur only when all disks are almost full.
Fix UTF8 encoding check routine to return correct path name length.
Based on number of clients that can connect simulteneosly, if correct value is set for socketMaxListenConnections, connection failure will not be observed by clients attempting to connect at the same time.
Fix to mmexpelnode to avoid indefinite blockage when a network partition is present and the target node is the cluster manager.
Fix EA limit calculation when metablock size is smaller than 64KB.
Fix mmapplypolicy in a mixed AIX/Linux cluster AND using the --sort-buffer-size option.
Fixed windows node assert using gpfsSetAllocFileSize on a datareplicated file system.
Fix mmrepquota to show human readable form instead of scientific notation for negative number.
Fixed a problem during quorum type change and when tiebreaker type is set to callback.
Permit mmbackup to analyze audit log even if "Failed" messages are not detected in STDOUT from dsmc selective command. Should help in rare cases where TSM runs out of space and exits rc=12 without emitting any of the usual failure messages.
Fix problem in enable fastea path when some other file system error happens at the same time, which interrupted enable fast ea operation.
Fix exception in GetReturnAddr following a cNFS grace period.
Fix large inDoubt left unclaimed problem after running chgrp command.
Add checking code to make sure sgID and inode number passed by dmapi handle are valid.
Prevent intermittent not-found errors when looking up snapshot pathnames while other snapshots are being deleted.
Change allocation code to prevent a deadlock that could occur when rebalance disks. This problem could only occur if there are large number of disk (over 32) and most of them 100% full.
Fix to a problem where when a file is opened with O_DIRECT, but there are other processes with the same file opened without this flag, the writes to the file do not get immediately updated on the disk.
Fix AIX crash or EINVAL error when calling gpfs_get_winattrs_path.
HoldDaemonSeg before referencing configuration flags in the segment.
Install this fix is you are using mmapplypolicy ... -i pathlist -g something ...
Eliminate possible FSSTRUCT error when accessing snapshots.
Restore quota file record size shortened by mistake in 3.4 and fix possible quota file checksum errors introduced by wrong record size.
This update addresses the following APARs: IV01082 IV01136 IV01138 IV01793 IV02033 IV02055 IV02253 IV02277 IZ99707.

Problems fixed in GPFS 3.4.0.6 [June 01, 2011]

Fix the mmchpolicy code which caused daemon assert after fail with E_NOENT error.
Fix a quota manager assertion where it could be caching invalid quota file inode after restripe.
Simplify expel cmd execution when multiple nodes including clmgr is specified in the cmd.
When TSM mangles path names, always leave the old shadow database in place and indicate an error by returning 12. Suggest next mmbackup be run with -q to synchronise shadow file to TSM.
Fix assert "!ofP->destroyOnLastClose" or apparent hang under certain workloads with concurrent directory updates from multiple nodes.
Fix for a rare race condition involving simultaneous mounts of different file systems that could lead to conflicting tokens being issued.
mmtracectl --off will now reset all trace config variables.
replace mhAclStore assert when stale ACL data is discovered.
Made the Windows code more robust in validating various GPFS handles and data structures before making GPFS internal calls. An inflight shutdown can race and cause various GPFS data structures to go invalid.
Modify the reporting of various file system allocation units in terms of GPFS sub-blocks. This forces the Windows Explorer to round up the disk usage for files to the nearest sub-block, which is consistent with the actual allocation size reported for files.
Fix a long waiter problem where the quorum is lost while the update mtime handler is already waiting for node recovery.
Fix for ProbeClusterThread waiting indefinitely for outbound connect during startup (problem occurs mainly on Windows nodes).
Add functionality to suspend write operations on a filesystem.
tsdbfs: avoid displaying Inode's wide address fields on narrow disk address filesystems.
Disallow immutable flag setting on narrow da fs.
Performance improvement in mmdf.
Persistent Reserve fix for database clusters where the nsd are directly-attached with many paths.
Clean up exit code reporting throughout. Add date/time stamp on exit. If tssnapdir command fails, add output to explain failure. Modify count of failed files to include skipped files in audit log. Permit failure exit if count of errors does not match count of Failed and Skipped files in audit log. Skip over pathnames in audit log if mangled. Permit shadow file update to record progress if all the failed pathnames can be elided properly even if mangled ones were skipped.
Wait recovery to finish before deldisk.
Fix long mmstartup delay on AIX after mmshutdown --force.
Fix code that could cause rare filesystem panic during sync.
Windows maximum shared segment size was increased from 256 MB to 1 GB and the maximum TM memory limit was increased from 1 GB to 128 GB.
Avoid extremely rare assert during unmount.
Replace portmap with rpcbind on SLES11 for CNFS.
Disable expiration time setting on narrow da file system.
Speed up node failure recovery for configurations with large values for maxFilesToCache.
Fix the Windows codepaths to call gpfsMmap specifying a valid byte-range.
Get rid of spurious "approaching limit for the maximum number of inodes" when a new FS manager takes over.
Ensure sdr server is not running on old configuration servers after rebooted.
Corrrectly set the list of registered RPC programs after restart portmap.
Fix CNFS failover problem with SLES11 or later.
Fix a deadlock that may occur in the presence of node failures.
Fix a GPL build break on RHEL 4.X when LINUX_KERNEL_VERSION=2060900.
Fix the allocation code which caused signal 11 under certain error condition.
Speed up traceback dumping on Linux by saving the symbol table the first time it is read.
Improve the fairness of the outbound RPC message queue, so that unlucky reply threads will not be stuck indefinitely under heavy communications loads.
Rare race condition causing spurious ENOSPC error when creating files.
Change the GPFS code for handleing the conversion of file handle to dentry to ESTALE to NFSD since ESTALE this the valid return code for file not found.
Change the SIGTERM and SIGINT signal handler and the methods it invokes so that all methods are "signal-safe", invoking only library calls that are Posix, specified as signal-safe. This code is still responsible for removing temporary files that tsapolicy creates.
There was a race/synchronization problem in the relatively new gpBS (buck slip) protocol that was introduced into rel 3.4 on 2011/02/25. This was fixed by adding code to synchronize of new flag p_beg2_sent, so that we are sure every session is bracketed by a begin... fini sequence.
Fix thread traceback stopping early and not translating some addresses to symbols.
Performance improvement in snapshot copy-on-write.
Fixed an invalid condition check that asserts the deamon instead of doing a proper cleanup while a filesystem manager takeover happens during quota check or fsck operation.
Fix problem when writing replicated data with direct-IO, where GPFS recovery after a node failure could interfere with concurrent updates to the same file from other nodes.
Prevent GPFS from starting when registering the pagepool to infiniband fails.
Make multi-threaded execution procedure local static constructors and/or destructors thread safe by adding code to avoid multiple execution.
Improve handling of symbolic links in mmbackup.
Improve error handling in mmbackup.
Prevent a rare FSSTRUCT error accessing large directory in a snapshot from multi-threaded application on AIX.
Fix a memory leak when getting extended attributes of a file.
Performance improvement in snapshot copy-on-write.
On 64 bit big endian architectures with 64 bit (void*) type and 32 bit (unsigned int) type, an old incorrect ccListVector::append() method stores the uint in memory such that a subsequent vec[i] access method retrieves 0000 instead of the stored value. A first attempted fix did not work due to a bug in the optimizing compiler (did work at level -O0), so a final fix was made to ts/pc/fc/cclistvect.h on 2011/05/06 using an explicit union type instead of "funky" casting.
Cleanup mmnfsmonitor monitor process after remove CNFS node.
Found TSM command exit codes were being discarded by execscript due to missing escape slash before $rc.
When exec script returns nonzero and mmapplypolicy returns EBADF(9) just print message and allow cleanup code to discern whether failure is fatal or not.
Change variable name to badPathCnt as itrepresents path names mangled by TSM, not files that were "skipped" by TSM because they were busy. Eliminate use of lstat() in determining this and simply see if backupDir is a common root of the failed path. If badPathCntis nonzero, will have to fail the backup.
Upgraded the Windows build environment to WiX 3.5, which includes an updated DifxApp.
Fixed regression caused by token management performance improvements.
Re-bury the --choice-algorithm=fast, so that program behaviour defaults to the old "exact" with sort choice algorithm. Also, fix the choice-algorith option propagation bug.
This update addresses the following APARs: IZ98687 IZ98699 IZ98702 IZ98771 IZ98981 IZ99353 IZ99355 IZ99356.

Problems fixed in GPFS 3.4.0.5 [April 07, 2011]

Avoid showing 'unknown' version in mmfslog.
Fix assignment causing unaligned access warning in Linux for IA64.
Fix logging recovery when data replication is enabled and metadata replication is not, or following a node failure.
Stop internal mount for lsquota command.
Change "mmwindisk initialize" to create the GPFS data partition with a 16MB alignment.
Allow a node which cannot externally mount a file system, due to page size restrictions, to still serve as file system manager.
Fix immutability flags being lost after a file is restored from TSM restore program.
Fix Signal 8 (divide by zero) error when processing a deleted inode for prefetch.
Write new filesystem device name to all disks to avoid the unwanted warning messages.
Added a post-install script in GPFS for Windows that runs "mmautoload postinstall".
Create gpfs init lock file on system startup. This ensures GPFS shutdown will be called during system shutdown on RHEL distributions.
Fix fileset metadata files with inode numbers outside the reserved range being handled as orphans.
Fix file system stopping with an assert on structure error related to an invalid number of disk pointers stored in the inode.
Fix quota file block expansion code resulting in an 'oldDiskAddrP == NULL' assert.
Allow user space attributes to be set by user commands.
Fix an inodeScan interface clean up error that could cause long waiters during unmount.
Fix panic in cxiStartIO when disk device drivers are configured for 1024 scatter gather lists.
Fix mmbackup failing to backup file with "NONE" in pathname.
Fix a fcntl retry message arriving and being processed before the original gpfs_v_lockctl operation completes. This could have resulted in the lock operation referencing the sleepElement after the message handler had freed it.
Rework the handling of options for mmapplypolicy to accept blank characters arguments.
Fix mmdeldisk allowing deleting a disk without moving existing data off the disk first. This would only have occured on file systems with metadata replication enabled (-m 2), strict allocation enforced (-K always; the default is "whenpossible"), when running mmdeldisk shortly after creating a new snapshot, and if the only disks remaining are in a single failure group.
Performance improvements to mmdelsnapshot.
Disallow the colon character in a filename during create/open from Windows. The Unix nodes can still create filename that have a colon. Such files can be accessed on Windows using their 8.3 names.
Fix excessive acquires on TcpConnTab mutex. Every five seconds, every receiver threads checks for broken connection timeout, when only one is needed.
Fix an bug in the log recovery code that was forcing a filesystem panic while offline fsck is in progress.
dump functions now dump regionsPerPass for each storage pool.
Fix fsck code so that it is able to recover data from a filesystem with a fatal root inode which is a candidate for delete.
Fix problem where mmdf would not allow specifying more than one of the -d, -m and -F options.
Fix when using EXTERNAL POOL EXEC 'script' rules with an external storage manager that supports "premigration", such as TSM/HSM, mmapplypolicy mistakenly invoked the rules' EXEC 'script' with the subcommand MIGRATE instead of PREMIGRATE for files that should be pre-migrated.
Fix for a bug where small synchronous writes to a block pre-allocated usinggpfs_prealloc may be lost.
Fix isStoragePoolIndexValid(poolIndex) asserts after a storage pool has been deleted.
This update addresses the following APARs: IZ94724 IZ95818 IZ95819 IZ95821 IZ95855 IZ96323 IZ96325.

Problems fixed in GPFS 3.4.0.4 [February 17, 2011]

Update mmtracectl to have --format and --noformat flags which allow one greater control over whether to format traces.
Fix rare race between flushBuffer and mergeInode updating lastDataBlock.
Fix a problem when RDMA connecting between two clusters where the IB networks are not connected.
Fix an assertion at daemon startup on 32 bit linux nodes when prefetchThreads and worker1Threads configuration variables are set too high.
Fix a bug in mmchdisk caused by premature loop exiting if a metadta disk and a data disk are found.
Add a make parameter "LINUX_DISTRIBUTION" for non-standard Linux distributions. e.g. make LINUX_DISTRIBUTION=REDHAT_AS_LINUX Autoconfig.
Fix race between nfsWatchdog and delsnapshot.
Fix the allocation code which caused an assert on filesystem manager node after encounter I/O error.
Fix code in displaying of cmd "mmlsfileset dev -L -p". Let this command show all the fileset status.
Fix a bug in mmwindisk utility (called from mmdevdiscover, for instance) that could cause the program to fail when the Windows node has certain uncommon storage devices attached.
Fix cxiIsNFSLock erroneously returning FALSE for NFSv4 lockctl calls.
Detect and skip the continuously repeated lines (from pgalloc), enable the MaxLoopCheck_dumpBufQueue and set it's default value to be 2, so it will not impact performance greatly.
Fix allocation code causing delete disk to fail when deleting last disk of a failure group.
Fix copyInodeBlock to not try to copy data block if it is EOF.
Fix Windows code to handle, or enable access on, all Unix filesystem object such as a block device, fifo, socket, symlinks. All such objects will be listed as 0 byte files on Windows. No other operation such as read/write/delete/modify will be allowed from Windows.
Fix code which caused long waiters and daemon shutdown on leaseloss.
Fix sublock to disk sector conversion routines handling invalid disk addresses. This is done by returning E_INVAL back to the caller during fsck scan.
Fix a race condition which can cause daemon shutdown when adding/deleting disk from the file system and when the inode prefetch thread is hitting a tiny time window.
Improve performance of file system metadata scan phases of mmrestripefs.
Add gpfs_set_times() and gpfs_set_times_path() API.
Avoid assert when a snapshot is created immediately after deleting a large file.
Fix subblock size not keeping consistency among the cluster.
Fix mmrestripefs or mmdeldisk command, after being killed, background activity continueing for a significant time.
Fix code which could cause daemon assert and segmentation fault during filesystem takeover.
Include mount event disposition in dm_get_disp() call.
Fix invalid assert in fcntl lock token relinquish path.
Fix lost quota code when calling tslsquota -j with fully qualified device name specified.
Prevent GPFS from starting while certain admin commands are running.
Fix assertion in mmcheckquota when it encounters quota entries with invalid fileset ids.
GPFS for Windows now disables SMB2 on the node during installation.
Fix unnecessary work during mmrestripefs and mmdeldisk commands.
Fix quorum formation when the /var/mmfs/gen/BallotFile file is too small.
Fix a longwaiter problem caused by and infinite loop in mmdefragfs.
Fix kernel assert in gotVinfoLock when doing read/write mmap.
Fix a workload that continuously invokes operations that require exclusive inode locks, such as chmod or chown, could prevent mmrestripefs or mmdeldisk commands from making progress.
Fix rsh/rcp failing in mmcrcluster when the second interface is being used to create a node and the hostname interface does not have permission.
Fix connecting to server, when running mmsdrcli, in cluster with daemon and admin on two different interfaces.
Do not return windows attributes blindly for gpfs_fgetattrs() API.
Fix file creates and deletes being blocked for a long time after a node failure, especially in file systems with a large number of inodes.
Fix allocation code to prevent an assert that could occur while trying to delete/replace disk.
Fix the fsck block compare method to support variable data / metadata block size routines failing and resulting in asserts during the fsck compare operation.
Fix file system policy information obtained by mmsnmpagentd.
Fix mmsdrfs generation changed event in events exporter.
Ensure the scope of remaining configuration parameters is not changed as a result of a delete operation on a configuration parameter.
Always refresh session list that registered for mount. This avoids a mount failure scenario where the session could be deleted or added while another node is processing the mount event.
Improve GPFS admin commands initiated on a daemon down node, forcing the execution to run on an active node, in a large cluster.
Fix IcQueryDirectory implementation for FILE_ID_BOTH_DIR_INFORMATION and FILE_ID_FULL_DIR_INFORMATION to correctly assign the file ID field.
Fix performance when sequentially overwriting an existing file in contiguous sector-aligned pieces that are less than the block size, do not read or prefetch any data.
Add GPFS mount options nfsHashName and nonfsHashName. If nfsHashName is in effect, the NFS FH will include the hash value of the file name. This option will improve performance but is off by default. Turning it on might cause some ENOENT error with NFS.
Fix ACL garbage collector delete auto-generated Window SID mappings.
Fix race condition starting too many mmkprocs when using many mmapped files.
Change the allocation code to prevent looping when migrating blocks after a disk's failure group assignment, data type or storage pool has changed.
Use seqDiscardThreshhold for determining if a buffer stays in pagepool after it has been consumed by a reader, or after it has been flushed by a writebehind thread. This allows setting a large seqDiscardThreshhold to cache most files below that size. Setting a low writebehindThreshold will start flushing sequentially written files so that a large pagepool does not fill up with dirty buffers.
Improve performance of snapshot, copy-on-write in particular, immediately after the snapshot is created and a large number of files are updated from multiple nodes in the cluster.
Fix gpfsInodeCache slab (and cpu) usage high due to NFS anon dentry allocations.
Improve sync performance when many dirty buffers.
Fix race condistion when performing extensive AIO on a node.
Add padding variable to SGPoolDataStored structure to prevent data misalignment.
Update gpfs_fcntl.h copyright statement.
Fix code in initializing a dummy super block "shutdownSuperP", which may cause kernel crash in some of the Linux kernel versions.
This update addresses the following APARs: IZ90535 IZ90866 IZ92310 IZ92316 IZ92318 IZ92320 IZ92325 IZ92330 IZ92413 IZ92427 IZ92467.

Problems fixed in GPFS 3.4.0.3 [January 06, 2011]

Fix assert happening in setCachedRecAddr when the cached disk address is NULL while the disk address read from disk is a real disk address. Modify the assert to allow this kind of change. And, update the cached address locally.
Fix a potential metadata allocation problem where wrong disk may be selected-occurs in selectRandom code branch when invoked in getRandomTargetDisk.
Fix repeated RDMA connection attempts due to IBV_EVENT_PORT_ERR.
Fix AIX crash caused by kxFreeAllSharedMemory.
Fix code, when value of the option "-p" for cmd mmcrfileset is invalid, returning misleading error message, "InvalidOption".
Fix mmbackup of fs with no changes sending files to TSM.
Fix mmbackup migration from straight TSM, older backup format (3.2), or recovery when shadow file not present would cause full backup.
Avoid very rare assert (BaseFilesetMetadataRecord) during restripe operations such as mmdeldisk.
Fix a deadlock between the tsdeldisk and the inode expansion.
Fix: An additional characteristic of pathnames with special characters present is they can cause TSM to exit with rc=4. Sometimes this was being mis-handled in mmbackup because the highest and "net status" error code from all the runs of TSM was not recorded/provided.
Permit TSM install to be in "bin64" for AIX and find needed config file (dsm.opt) there. Provide enhanced debugging in tsbackup33 using DEBUGmmbackup bits.
Add new functions to carefully split file list lines and notice if the split char is showing up in the file name as well.
Fix the allocation code which can cause a filesystem to panic with "Too manydisks are unavailable" when running out of disk space.
Fix a rare race condition where a file system manager failure during a disk status change could cause temporary loss of file system access.
Fix kernel assert when dmapi event generator is accessing null sgP pointer.
Fix mmcheckquota showing confusion error message when scanning large fs. This was due to insufficient memory.
Provide inode space expansion during directory entry creation if new inode number is out of range.
Fix an erroneous assert check in fsck cleanup path.
Fix rare deadlock that occurs if NSD server fails during mmcrfs cmd.
Fix mmapplypolicy having an internal error. Or, as a workaround, avoid using -i and -g and -N together.
Provide support for recognizing DSM_CONFIG env variable in mmbackup.
Fix mmimgbackup failing when rebooting another node. Keep tsapolicy exit code at 0 when recoverable or expected errors occur. Important for scripted usage of mmapplypolicy depending on mmapplypolicy exit code to be 0-even during multi-node operation, or when one or more "helper" nodes fail.
Fix FSErrValidate error in ACL GC while inode expansion is also running.
Provide a --block-size option for the mmlssnapshot and mmlsfileset commands.
Fix race condition between two remove threads removing same file.
Fix deleting a snapshot containing sparse files that could, in some rare cases, cause temporary loss of file system access.
Fix race condition between deferred deletions and policy file creation.
Fix assert "aceLength > 0" in tsgetacl for default ACL on a dir in a remote fs.
Fix a rare problem in mmrestorefs error code path- CHECK_CONTINUE_ON_ERROR was starting the next inode without advancing inode block buffer to next inode buffer pointer.
Fix asserts in fsck while trying to fix corrupt directories.
Fix deadlock preMount callback invokes mm commands.
memcmp now defined in rtnetlink.
Fix permitting FSET snap handles inappropriately modifying the fssnap->magic number prior to a tsfattr(GPFS_SYNC_FS).
Fix for quote error in the m4 command invocation when running mmapplypolicy.
Relocate mmbackup related temporary files from root to /.mmbackupCfg/.
Fix sort->$sort.
Permit recovery after non-fatal TSM error codes.
Improve GPFS mmstartup time & other GPFS commands in adminMode=allToAll cluster.
mmexpel --wait command aborts the wait in case of quorum loss.
Avoid structure error assert after mmdelsnapshot when cached files in other snapshots are accessed.
Fix buffer length calculation for dmapi user event returned by dm_get_events call.
Fix dm_handle_to_path so that it can look up the directory name by its own handle.
Fix rare assert in fsync code path.
Fix problem of disk going off line with error 733.
Fix mmrestoreconfig failing. This occurs when quota command returns E_NO_QMGR while file system is being closed but, has not completely closed yet.
Fix problem of disk going off line with error 735.
Fix return code of appendOnly file checking routine.
Improve mmdeldisk progress time.
Add additional exmaple files, tspgrep and tsprm, to samples/ilm.
Fix a remote cluster not always picking a local NSD server when readReplicaPolicy=local is set.
Fix a startup synchronization issue that prevented GPFS autoload from working on some Windows systems.
Fix to fputattrs to restore/clear xattrs and to fputattrs_withpathname to not overwrite pathname once copied into the kernel. Users of IBM Tivoli Storage Manager Backup Archive Client and GPFS storage pools with policy RESTORE rules for data placement should apply this fix before restoring data to the GPFS file system.
Improve performance of small writes (<32k) over NFS to a file opened with with O_DIRECT on the NFS client.
Fix Linux crashing in cxigetinodenum on lockd call.
Fixed mmchfs code path that is leaving filesystem mounted internally.
Add support for RHEL 4.X x86_64.
Fix mmlssnapshot with -d option not showing data and metadata usage.
mm commands now display conflicting messages when the command is waiting to run, due to a conflicting program running, instead of after it has finished.
mmapplypolicy now suppresses progress messages if a non-interactive device is being used.
Fix the fsck block compare operation that results in a SEGV due to buffer overrun.
Reduce message traffic when writing a file with NFS.
Fix synchronization of dmapi destroy event thread and dmapi event response thread.
Fix assert in dmapi event timeout handlers.
Fix forced unlink of a fileset (mmunlinkfileset -f) on Linux causing temporary loss of file system access if there were deleted files still open in the fileset at the time it was unlinked.
Use TRCBUFSIZE environment variable for trace buffer size and ensure it is not overwritten by config parameter.
Fix some 64 bit counters in GPFS SNMP.
Properly restore windows attributes.
Improve performance of mixed random read/write workloads on large files over NFS.
Fix an invalid conditional assert in the fsck orphan management code.
Fix mmrestoreconfig failing, with tsdefquotaon failed rc=245, if quota command returns E_NO_QMGR while file system is being closed, but has not completely closed yet.
Avoid asserts and deadlock by having mmlsfileset and mmlssnapshot commands wait while mmcrsnapshot command runs.
Fix logAssertFailed: rmr1 != rmr2 when using GPFS RDMA.
Fix enabling fs with diskea and overflow block feature.
Fix a startup synchronization issue that prevented GPFS autoload from working on some Windows systems.
Fix a SEGV problem in mmlsquota when printing user quotas for a fileset.
Fix a case in mmchfs which leaves the FS internally mounted for a small time period after mmchfs is over.
Initialize filesetNameP.
Fix deadlock issue for flushing mmapped files.
FILESET_CMD_PERM for mmchfileset on Windows has been temporarily disabled.
Fix a startup synchronization issue that prevented GPFS autoload from working on some Windows systems.
Fix Linux mmdelacl returning E_OPNOTSUPP for files in a "-k nfs4" fs.
Add useDIOXW configuration variable to avoid Direct IO token thrashing when using some IO requests that match the GPFS blocksize.
On SLES11, a privileged user is now not allowed to create a file in a remote filesystem even though root squashing is enabled because the DAC_OVERRIDE capability was specified in the credential.
Fix mmbackup recording failed files incorrectly.
Update unlinked fileset handling code to properly cull paths from a new (3.4)-style shadow file and sort by inode number into the updated list file. Exempts the unlinked fileset contents from being expired from TSM.
Fix duplicate session id returned by dm_create_session due to clock out of sync problem.
Speed up snapshot creation and unmount on systems with a large amount of dirty data in the cache.
Suppress implicit file time updates after an explicit set time operation was perform on the same handle-these semantics only apply to Windows systems.
Allow dmapi clients to acquire access rights to a file that is being destroyed.
Add two new API's which can be used to improve performance for applications that make many API calls on Linux.
Tweak TSM Query code to recover files more accurately when doing shadow file reconstruction, including file names with break chars in the name.
Improve performance of random updates to a large file from a single node, if that file was previously accessed by another node.
Fix an assert during multiple instances of restripe running in parallel.
Fix a surplus indirect block not being processed during restripe.
Fix that could cause some files to become unreadable when running mmrestripefs on a system with small page pool or a workload that causes high demand for page pool buffers.
Speed up the reclaim of unused GPFS inodes on Linux.
Do not allow GPFS internal extended attributes to be set using the gpfs_fputattrs API. Require root authority to set DMAPI external attributes or external namespace attributes other than "user."
Avoid problems preventing upgrading v3.3 filesystems with snapshots.
Fix problem of restoring EA of pre 3.4 file system without fastea enabled.
This update addresses the following APARs: IZ86550 IZ87150 IZ87153 IZ88685 IZ88701 IZ88704 IZ88745 IZ88747 IZ88748 IZ88749 IZ88752 IZ88828 IZ88900 IZ88904.

Problems fixed in GPFS 3.4.0.2 [October 07, 2010]

FSCK checks log file inodes even if they have log group number set to -1.
gpfsInodeCache slab (and cpu) usage high due to NFS anon dentry allocations.
Fix rare occurrence of file fragment expansion happening during file sync that can cause the assert failure related to GETSUBBLOCKSPERFILEBLOC.
If node cannot do cNFS recovery for a failed node then commit suicide so another node can do the takeover for both nodes.
Prevent FGDL kernel memory fault caused by very narrow race condition during directory lookup.
Fix assert related to RCTX.REPLIED, TSCOMM.C that occurs on the FS manager node if the FS manager is running GPFS release 3.2, and a release 3.3 client tries to mount the filesystem.
Linux IO: check mm_struct before pinning pages.
Improve performance of stat operations on Linux under certain multi-node access patterns.
Fixed an incompatibility between GPFS for Windows and the Interop Systems software bundles. This incompatibility caused Interop Systems bundle installation failure.
Fix hang between node join thread and events exporter request handler thread.
This update addresses the following APARs: IZ81230 IZ83798 IZ84008 IZ84016 IZ84039 IZ84041 IZ84045 IZ84145 IZ84161.

howto://Configure Splunk to accept syslog feeds

2011-11-25T10:13:00.000-03:00

howto://Configure Splunk to accept syslog feeds

IBM Virtualization overview

2011-11-20T17:38:00.001-03:00

Introduction to IBM PowerVM

2011-11-20T17:38:00.000-03:00

AIX 6 Security Features Overview

2011-11-19T12:33:00.000-03:00

TZ problems on AIX 6100-07-01-1141 and 7100-01-01-1141

2011-11-11T10:58:00.000-03:00

TZ problems on AIX 6100-07-01-1141 and 7100-01-01-1141

Technote about boot problem (LED 517 or 518)

2011-11-10T10:00:00.001-03:00

Question

Repairing File Systems with fsck in AIX V5 or V6 (LED 517 or 518)

Answer

This document covers the use of the fsck (file system check) command in Maintenance mode to repair inconsistencies in file systems. The procedure described is useful when file system corruption in the primary root file systems is suspected or, in many cases, to correct an IPL hang at LED value 517, 518, or LED value 555. This document applies to AIX version 5.x, 6.x, and VIOS LPAR.

Boot your system into a limited function maintenance shell (Service, or Maintenance mode) from AIX bootable media to perform file system checks on your root file systems. Please refer to your system user's or installation and service guide for specific IPL procedures related to your type and model of hardware. You can also refer to the document titled "Booting in Service Mode," available at Booting AIX in Single-User Mode.
With bootable media of the same version and level as the system, boot the system. If this is a VIOS LPAR, use the correct VIOS media. The bootable media can be any ONE of the following:
- Bootable CD-ROM
- NON_AUTOINSTALL mksysb
- Bootable Install Tape
Follow the screen prompts to the following menu:
```
   Welcome to Base Operating System
   Installation and Maintenance
```
Choose Start Maintenance Mode for System Recovery (Option 3).The next screen displays the Maintenance menu.
Choose Access a Root Volume Group (Option 1).The next screen displays a warning that indicates you will not be able to return to the Base OS menu without rebooting.
Choose 0 continue.The next screen displays information about all volume groups on the system.
Select the root volume group by number.
Choose Access this volume group and start a shell before mounting file systems(Option 2). If you get errors from the preceding option, do not continue with the rest of this procedure. Correct the problem causing the error. If you need assistance correcting the problem causing the error, contact one of the following:
- local branch office
- your point of sale
- your AIX support center
If no errors occur, proceed with the following steps.
Run the following commands to check and repair file systems.NOTE: The -y option gives fsckpermission to repair file system corruption when necessary. This flag can be used to avoid having to manually answer multiple confirmation prompts, however, use of this flag can cause permanent, unnecessary data loss in some situations.
```
 fsck /dev/hd4
 fsck /dev/hd2
 fsck /dev/hd3
 fsck /dev/hd9var
 fsck /dev/hd1
```
To format the default jfslog for the rootvg Journaled File System (JFS) file systems, run the following command:
```
 /usr/sbin/logform /dev/hd8
```
Answer yes when asked if you want to destroy the log.
If your system is hanging at LED 517 or 518 during a Normal mode boot, it is possible the/etc/filesystems file is corrupt or missing. To temporarily replace the disk-based /etc/filesystemsfile, run the following commands:
```
 mount /dev/hd4 /mnt
 mv /mnt/etc/filesystems /mnt/etc/filesystems.[MMDDYY]
 cp /etc/filesystems /mnt/etc/filesystems
 umount /mnt
```
MMDDYY represents the current two-digit representation of the Month, Day and Year, respectively.
Type exit to exit from the shell. The file systems should automatically mount after you typeexit. If you receive error messages, reboot into a limited function maintenance shell again to attempt to address the failure causes.
If you have user-created file systems in the rootvg volume group, run fsck on them now. Enter:
```
 fsck /dev/[LVname]
```
LVname is the name of your user-defined logical volume.
If you used the preceding procedure to temporarily replace the /etc/filesystems file, and you have user-created file systems in the rootvg volume group, you must also run the following command:
```
 imfs -l /dev/[LVname]
```
If you have file systems in a volume group other than rootvg, run fsck on them now. Enter:
```
 varyonvg [VGname]
 fsck /dev/[LVname]
```
VGname is the name of your user-defined volume group.
If you used the preceding procedure to temporarily replace the /etc/filesystems file, also run the following command:
```
 imfs [VGname]
```
The preceding commands can be repeated for each user-defined volume group on the system.
If your system was hanging at LED 517 or 518 and you are unable to activate non-rootvg volume groups in Service mode, you can manually edit the /etc/filesystems file and add the appropriate entries. The file /etc/filesystems.MMDDYY saved in the preceding steps may be used as a reference if it is readable. However, the imfs method is preferred since it uses information stored in the logical volume control block to re-populate the /etc/filesystems file.
If your system has a mode select key, turn it to the Normal position.
Reboot the system into Normal mode using the following command:
```
 sync;sync;sync;reboot
```

If you followed all of the preceding steps and the system still stops at an LED 517 or 518 during a reboot in Normal mode, you may want to consider reinstalling your system from a recent backup. Isolating the cause of the hang could be excessively time-consuming and may not be cost-effective in your operating environment. To isolate the possible cause of the hang, would require a debug boot of the system. Instructions for doing this are included in the document "Capturing Boot Debug". It is still possible, in the end, that isolation of the problem may indicate a restore or reinstall of AIX is necessary to correct it. If you need assistance correcting the problem causing the halt, contact one of the following:

local branch office
your point of sale
your AIX support center

Listado comandos AIX

2011-11-08T15:21:00.000-03:00

Listado comandos AIX

Upgrading your AIX environment using multibos

2011-11-07T11:49:00.001-03:00

Upgrading your AIX environment using multibos

If you haven’t clued on by now, AIX is my operating system of choice. I’m sure there are many arguments for and against, but looking at it from a systems administrator view point, it’s second to none. Anyway, that’s a story for another time. What I’m writing about today is patching your AIX installations using multibos. Now before I get started, I’ll stress two points:

1) Chris Gibson has already written two great (and far more in depth) articles on multibos, which I recommend reading before going any further (Links: here and here).
2) This blog of mine serves two purposes; To share some of the things I come about during my sysadmin activities and secondly also a dumping ground for documents I write for myself. This post is the latter, as multibos isn’t something that I use daily (maybe a few times a year), and really, who’s going to remember all those syntax switches

Now, assuming you’ve read both articles, I don’t need to go into the benefits of multibos and I’ll dive straight into the how. I’ll be working on upgrading an AIX instance running 6100-05-01-1016 to the latest ML which at the time of writing is 6100-06-04-1112

PREREQUISITES
First things first, we need to make sure the current environment is ready to be copied. The two main things that I look for are:

1. Make sure the current environment doesn’t have any missing filesets.

root@AIX / > oslevel -s
6100-05-01-1016
root@AIX / > instfix -i | grep ML
    All filesets for 6100-00_AIX_ML were found.
    All filesets for 6100-01_AIX_ML were found.
    All filesets for 6100-02_AIX_ML were found.
    All filesets for 6100-03_AIX_ML were found.
    All filesets for 6100-04_AIX_ML were found.
    All filesets for 6100-05_AIX_ML were found.

**Note: If a particular ML doesn’t return positive (e.g. 6100-05_AIX_ML), use instfix -ciqk 6100-05_AIX_ML | grep “:-:” to see the fileset causing issues and rectify it.

2. Make sure all filesets have been committed. Now I’m not entirely sure if this is a requirement, but I prefer to work with an as clean environment as possible.

root@AIX / > lslpp -l | grep -i applied

**Note: If you have software which is in an applied state, commit it.

Now that we’re happy with the state of the environment, you need to verify that there is enough room in rootvg to make copies of the following logical volumes [/ (hd4), /usr (hd2), /var (hd9var), /opt (hd10opt) and the boot logical volume (hd5)].

Once we’ve satisfied the above requirement, we can get started with the multibos work. I’m not going to dissect each command, so I suggest reading the multibos man pages to know what each switch does. The only one that I’ll explain is -p, which does a preview of the multibos command executed.

MULTIBOS
1. Remove any previous standby multibos environments. The below command will return a FAILURE status if you don’t have a standby multibos environment. If you’re using multibos for the first time, this will be the case.

root@AIX / > multibos -RX
Initializing multibos methods ...
Initializing log /etc/multibos/logs/op.alog ...
Gathering system information ...
multibos: 0565-077 Unable to locate standby BOS.
 
Log file is /etc/multibos/logs/op.alog
Return Status: FAILURE

2. Create the standby BOS. New logical volumes and filesystems will be created prefixed and with bos_. This can take a while to complete.

This will preview the creation of the multibos environment and list all the logical volumes that will be copied.

root@AIX / > multibos -sXp
...
...
Log file is /etc/multibos/logs/op.alog
Return Status = SUCCESS

You can also view the log file using the alog command.

root@AIX / > alog -of /etc/multibos/logs/op.alog

If everything completed successfully, run the command again without the preview.

root@AIX / > multibos -sX

Once complete, you’ll notice that the new logical volumes will be prefixed with bos_

3. Once complete, you can drop into a multibos shell and check oslevel, it should be the same as the host OS.

The below command will mount all the filesystems required and drop you in a MULTIBOS> prompt

root@AIX / > multibos -S
...
...
MULTIBOS> oslevel -s
6100-05-01-1016

To umount all the filesystems and break out of the multibos environment.

MULTIBOS> exit

4. Apply the TL/ML to the multibos environment.

The below command will tell multibos to apply the updates from the specified location (which is the location that your new ML resides).

root@AIX / > multibos -Xac -l /home/kristijan/6100-06-04

Drop into the multibos shell again and check that the ML has been successfully applied.

root@AIX / > multibos -S
MULTIBOS> oslevel -s
6100-06-04-1112
MULTIBOS> instfix -i | grep ML
     All filesets for 6100-00_AIX_ML were found.
     All filesets for 6.1.0.0_AIX_ML were found.
     All filesets for 6100-01_AIX_ML were found.
     All filesets for 6100-02_AIX_ML were found.
     All filesets for 6100-03_AIX_ML were found.
     All filesets for 6100-04_AIX_ML were found.
     All filesets for 6100-05_AIX_ML were found.
     All filesets for 6100-06_AIX_ML were found.
MULTIBOS> exit

5. Verify that the bootlist now contains blv=bos_hd5. bos_hd5 is the location of the new boot logical volume. It will be at the top of the list when you run the bootlist command.

root@AIX / > bootlist -m normal -o
hdisk0 blv=bos_hd5 pathid=0
hdisk0 blv=hd5 pathid=0

You can now reboot into the new environment and verify that all went to plan.

6. If you need to back out of the change for any reason, just change the bootlist order back to blv=hd5 and reboot. Now, while this doesn’t bother me, it may bother others. You’ll notice after the reboot that your environment is now using the bos_ logical volumes. The only way to get your environment back to how it was using the original logical volume names is to create another multibos environment, and reboot into it. Since your current boot environment is using the bos_ logical volumes, it will create it using the original logical volume names (i.e. without the bos_). For those that want to do that, redo step 2 and reboot. However, I suggest not doing this for a week or so to be sure you’re happy with the new changes, as creating a new multibos environment will remove the backup environment with the previous ML.

As always, post comments/questions below.

Thanks to http://www.kristijan.org

IBM Systems Magazine - Working With multibos

2011-11-07T11:28:00.000-03:00

IBM Systems Magazine - Working With multibos

Multibos and life

2011-11-07T11:14:00.004-03:00

I love multibos. It's great! It's an excellent way to roll through TL updates, and test all sorts of stuff.

The only thing I don't like about it is you can't really leave your server in your multibos shell. You can, but it can break things later on.

For example, let's say you have server_a, and it's at 6.1.4.4 and it's very critical, and you want to bring it up to 6.1.4.6. You can use multibos to bring it up to that level of 6.1.4.6, and keep the old 6.1.4.4 in the old multibos shell in case you need to roll back. However, if you leave your system in the new one, and you go to do a nimadm operation down the road - you won't be able to because your LV's will be named bos_hd5 etc.

So now what I do is this:

1. Upgrade server to new level using multibos.
2. Test and let sit for a week.
3. multibos -R (remove our old instance)
4. multibos -sX (create duplicate instance)
5. Change bootlist and boot into new instance.
6. multibos -R

Before I would just let the server sit there with the old instance until the NEXT update, that way the option of always going back is there.. but it's easy to forget your LV's are not named correctly when you're trying to do other things :).

Thanks to Andrew Wojnarek

Paging Space Consumer

2011-11-04T16:39:00.003-03:00

Here is an easy way to figure out what processes are taking up your valuable paging space:

svmon -P -O sortseg=pgsp | more

Problems with multibos

2011-11-04T16:33:00.000-03:00

This little gem will keep your head from spinning off your shoulders when you have a multibos fail to clean up (multibos -R).

This can happen when a multibos install gets interrupted, or something weird happens – it’ll hose up the whole multibos instance, and won’t let you remove it. Here is what it will look like:

user@computer:$ multibos -R
Initializing multibos methods ...
Initializing log /etc/multibos/logs/op.alog ...
Gathering system information ...

+-----------------------------------------------------------------------------+
Remove Operation
+-----------------------------------------------------------------------------+
Verifying operation parameters ...

+-----------------------------------------------------------------------------+
Boot Partition Processing
+-----------------------------------------------------------------------------+
multibos: 0565-084 Error processing primary boot partition.
multibos: 0565-002 ATTENTION: cleanup did not complete successfully.
Log file is /etc/multibos/logs/op.alog
Return Status: FAILURE

Here are some step to fix this:

1. Unmount the remaining multibos filesystems:

umount filesystem name
rmfs filesystem name

2. Once these have been cleaned up, remove the old rootvg volume group.

varyoffvg oldrootvg
exportvg oldrootvg

3. Migrate your rootvg volume group from hdisk2 and 3 (or wherever there current location is) over to 0 and 1.

migratepv hdisk2 hdisk0
migratepv hdisk3 hdisk1

4. Remove the boot device.

Rmlv hd5

5. Next, you need to clear the boot information off of hdisk0, 1, 2 and 3 (the new location for rootvg and the old location for rootvg.

chpv –c hdisk0
chpv –c hdisk1
chpv –c hdisk2
chpv –c hdisk3

6. Next, create a new boot logical volume. For the label, make sure you put “primary_bootlv”.

smitty lv
Or
mklv –y ‘hd5’ –t ‘boot’ –a ‘e’e –L ‘primary_bootlv’ rootvg 1

7. Then you will need to write bootcode to your boot device.

bosboot –ad hdisk0
bootlist –m normal hdisk0 blv=hd5
savebase

8. Now you should be able to run the multibos –R to delete the multibos shell.

El sistema de log

2011-10-25T10:45:00.002-03:00

El sistema de log

Al igual que sucede en cualquier sistema Unix, en AIX la información y los errores generados por eventos en el sistema son gestionados por el demonio syslogd, que en función de su configuración (en el archivo /etc/syslogd.conf) envía sus registros a consola, a un fichero, a un programa, a otro sistema...tal y como se explica en el capítulo dedicado a la auditoría de sistemas Unix. No obstante, además de syslogd, AIX proporciona otro mecanismo para la gestión de errores y mensajes del hardware, del sistema operativo y de las aplicaciones, ofreciendo una información muy valiosa para determinar cualquier tipo de problemas en el entorno ([Skl01]); mientras que por defecto syslogd no realiza ningún tipo de registro en AIX, este sistema no necesita ningún tipo de configuración adicional para comenzar a realiza su trabajo. Además, viene `de serie', ya que este mecanismo adicional forma parte de los paquetes bos.rte ybos.sysmgt.serv_aid, instalados por defecto con el operativo:

bruja:/etc# lslpp -l bos.rte bos.sysmgt.serv_aid
  Fileset                    Level  State      Description         
  --------------------------------------------------------------------------
Path: /usr/lib/objrepos
  bos.rte                 4.3.3.10  COMMITTED  Base Operating System Runtime
  bos.sysmgt.serv_aid     4.3.3.50  COMMITTED  Software Error Logging and
                                               Dump Service Aids

Path: /etc/objrepos
  bos.rte                  4.3.3.0  COMMITTED  Base Operating System Runtime
  bos.sysmgt.serv_aid     4.3.3.50  COMMITTED  Software Error Logging and
                                               Dump Service Aids
bruja:/etc#

Al arrancar una máquina AIX desde /etc/inittab se invoca a /sbin/rc.boot, shellscript donde se inicializa el demonio errdemon, encargado de monitorizar contínuamente el archivo /dev/error y crear los registros de error en el fichero correspondiente; a diferencia de syslogd, errdemon no escribe una entrada cada vez que se registra un evento, sino que lo hace mediante buffers tal y como se le indica en su base de datos de notificación de errores, /etc/objrepos/errnotify. Además, el registro de errores por defecto se mantiene en /var/adm/ras/errlog, mientras que el último log generado se guarda en memoria NVRAM de forma que en el arranque del sistema se añade al registro cuando se inicializa el demonio.

Los registros guardados por errdemon están en modo binario (a diferencia de los logs habituales en Unix) por defecto, como hemos comentado, dentro del fichero /var/adm/ras/errlog; de esta forma, para visualizarlos necesitaremos ciertas herramientas que vienen con el sistema; podemos utilizar desde línea de comandos la orden errpt o bien - como siempre en AIX - invocarla desde SMIT. En cualquier caso, mediante esta herramienta se genera en tiempo real un informe de errores:

bruja:/# errpt |head -2   
IDENTIFIER TIMESTAMP  T C RESOURCE_NAME  DESCRIPTION
AA8AB241   0506081102 T O OPERATOR       OPERATOR NOTIFICATION
bruja:/#

Como podemos ver, cada línea mostrada por esta orden es uno de los registros procesados; la primera columna es un identificador de error único y la segunda indica la hora en que se generó el mismo en formato mmddhhmmyy (mes, día, hora, minuto y año). La tercera describe el tipo de error registrado: una `T' indica que es temporal, una `P' que es permanente y una `U' que es desconocido. La cuarta columna define la clase del error (`S' para errores software, `H' para hardware y `O' para entradas generadas mediante errlogger, como veremos después). Finalmente, la quinta columna indica el recurso afectado, y la última una descripción del error. Si pensamos que el formato es algo complicado de interpretar a simple vista (quizás tengamos razón), podemos utilizar la opción `-a' de la orden, que muestra los registros con un mayor nivel de detalle, hasta el punto de indicar las posibles causas del problema y su solución (aunque realmente esta información no es tan útil como pueda parecer en principio):

bruja:/# errpt -a|head -36
-------------------------------------------------------------------------
LABEL:          SRC
IDENTIFIER:     E18E984F

Date/Time:       Mon May  6 07:02:05 
Sequence Number: 30479
Machine Id:      000000375C00
Node Id:         bruja
Class:           S
Type:            PERM
Resource Name:   SRC

Description
SOFTWARE PROGRAM ERROR

Probable Causes
APPLICATION PROGRAM

Failure Causes
SOFTWARE PROGRAM

        Recommended Actions
        PERFORM PROBLEM RECOVERY PROCEDURES

Detail Data
SYMPTOM CODE
           0
SOFTWARE ERROR CODE
       -9017
ERROR CODE
           9
DETECTING MODULE
'srchevn.c'@line:'288'
FAILING MODULE
qdaemon
-------------------------------------------------------------------------
bruja:/#

El archivo errlog es un registro circular, es decir, almacena tantas entradas como se define al arrancar el demonio errdemon. Al llegar una nueva entrada, se almacena primero en un buffer intermedio para minimizar la probabilidad de pérdida del registro, y a continuación se pasa al fichero errlog; en este punto, si se va a sobrepasar el tamaño máximo del archivo, se elimina la primera entrada registrada. Podemos consultar los parámetros de configuración actuales mediante errdemon, y quizás nos interese también modificar alguno de ellos en el arranque del sistema; por ejemplo, [Bha01] recomienda incrementar el tamaño por defecto de los buffers y del archivo de log para obtener un mejor registro de auditoría:

bruja:/# /usr/lib/errdemon -l
Error Log Attributes
---------------------------------------------
Log File                /var/adm/ras/errlog
Log Size                1048576 bytes
Memory Buffer Size      8192 bytes
bruja:/# /usr/lib/errdemon -s4194304 -B32768
The error log memory buffer size you supplied will be rounded up
to a multiple of 4096 bytes.
bruja:/# /usr/lib/errdemon -l
Error Log Attributes
---------------------------------------------
Log File                /var/adm/ras/errlog
Log Size                4194304 bytes
Memory Buffer Size      32768 bytes
bruja:/#

Otra herramienta interesante para trabajar con el sistema de registro de AIX es errlogger; la funcionalidad de la misma es similar a la de la orden logger en otros Unices: añadir entradas al fichero de log desde línea de comandos, por ejemplo a la hora de registrar eventos desde un shellscript:

bruja:/# errlogger Mensaje de prueba
bruja:/# errpt |head -2   
IDENTIFIER TIMESTAMP  T C RESOURCE_NAME  DESCRIPTION
AA8AB241   0506081102 T O OPERATOR       OPERATOR NOTIFICATION
bruja:/# errpt -a |head -25
-------------------------------------------------------------------------
LABEL:          OPMSG
IDENTIFIER:     AA8AB241

Date/Time:       Mon May  6 08:11:54 
Sequence Number: 30480
Machine Id:      000000375C00
Node Id:         bruja
Class:           O
Type:            TEMP
Resource Name:   OPERATOR

Description
OPERATOR NOTIFICATION

User Causes
ERRLOGGER COMMAND

        Recommended Actions
        REVIEW DETAILED DATA

Detail Data
MESSAGE FROM ERRLOGGER COMMAND
Mensaje de prueba
-------------------------------------------------------------------------
bruja:/#

AIX ofrece más herramientas para realizar diferente tareas sobre su sistema nativo de log: eliminar entradas (errclear), instalar nuevas entradas en el archivo de configuración (errinstall), detener el demonio errdemon (errstop). El sistema de log en AIX es una de las características más potentes que el operativo nos ofrece, proporcionando un nivel de detalle y granularidad en la clasificación de eventos muy superior al de syslogd; no obstante, la cantidad de información registrada, y el hecho de que no existan herramientas `de serie' (realmente sí que las hay, en muchos casos simples scripts desarrolladas por terceros) que informen de algún modo especial ante errores graves, hacen que no se consulte mucho el log y se pierdan entradas que son importantes, no sólo en lo referente a la seguridad del sistema sino también en lo que concierne a su estabilidad.

Aix 6.1 + PowerVM + Hdlm + Gpfs + Oracle Clusterware + Grid Control + Rac 11gr2 + AMS2100

HP/UX system administration

NPIV Setup and Configuration to Virtualize Fibre-channel card on IBM p6

1. Basic Requirements will contain:

2. Benefits:

3. Disadvantages:

Grow your rootvg on the fly (from 6.1 TL 4)

HMC GUI Access to VIOS command

How can I mount an ISO image file?

With AIX 6.1 TL4 or newer you can use loopmount:

How can I list filesets and versions on installation media?

I want to know what filesets are present on installation media or a on a directory where I put some files with not human readable names (such as U838402.bff). How can I get the information?

How can I create a backup ethernet adapter?

How can I see the allocated resources of an LPAR w/o checking on the HMC?

Run this command on your LPAR:

How can I figure out the managing HMC (and CSM server) of my LPAR?

To find the managing servers of your LPAR you can use the domain status information - the ctrmc subsystem must be active in order to do so. You can check with:

How can I archive a directory with backup?

tar on AIX has severe limitations. If I want to archive an directory without these limitations I think about the backup command. But what would be the syntax?

VULNERABILITY: Vulnerability in AIX TCP stack

Problems in previous version to GPFS 3.4.0.7

howto://Configure Splunk to accept syslog feeds

IBM Virtualization overview

Introduction to IBM PowerVM

AIX 6 Security Features Overview

TZ problems on AIX 6100-07-01-1141 and 7100-01-01-1141

Technote about boot problem (LED 517 or 518)

Listado comandos AIX

Upgrading your AIX environment using multibos

Upgrading your AIX environment using multibos

IBM Systems Magazine - Working With multibos

Multibos and life

Paging Space Consumer

Problems with multibos

El sistema de log

El sistema de log

I want to know what filesets are present on installation media or a on a directory where I put some files with not human readable names (such as `U838402.bff`). How can I get the information?

To find the managing servers of your LPAR you can use the domain status information - the `ctrmc` subsystem must be active in order to do so. You can check with: