Solaris 10 sparc xymon 4.3.10 issue ?

  Aha, there was a long burried issue on our apache server in a customlog 
setup which had never been an issues until xymon was turned on.  There 
was no redirect, /bin/tee was opening everything listed after it 
including "|" and "/bin/logger" and appending to them the apache logs...
it must be a monday... :)

Matt

And now a bit of polka music by "Ralph Mitchell"

If something was appending to the /usr/bin/logger binary, you might want to
check your various scripts for code that does:

     ....... > /usr/bin/logger

instead of:

     ..... | /usr/bin/logger

Ralph Mitchell
On Oct 8, 2012 12:50 PM, "Matt Goebel" <user-74d13dabeb26@xymon.invalid> wrote:

Yes... /bin/logger is a binary...

I seem to have figured out the issue, fping was being run as root by xymon,
so I did the following :

so I removed the sticky bit from user and group on /usr/local/sbin/fping

then I did the following and restarted xymon

add in : /etc/security/exec_attr
Network Management:solaris:cmd:::/usr/local/sbin/fping:privs=net_icmpaccess

add in : /etc/user_attr
xymon::::defaultpriv=basic,net_icmpaccess

Matt

--
Matthew Goebel : user-74d13dabeb26@xymon.invalid : Unix Jockey @ EMU : Hail Eris
Neo-Student, Net Lurker, Donut consumer, and procrastinating medher...
 "Always with the negative waves, Moriarty" - Oddball
 "Comfort the troubled, and trouble the comfortable." - Dietrich Bonhoeffer

--bcaec54fb0c030d40f04cb8f19b6
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

<p dir=3D"ltr">If something was appending to the /usr/bin/logger binary, yo=
u might want to check your various scripts for code that does:</p>
<p dir=3D"ltr">=A0=A0=A0=A0 ....... &gt; /usr/bin/logger</p>
<p dir=3D"ltr">instead of:</p>
<p dir=3D"ltr">=A0=A0=A0=A0 ..... | /usr/bin/logger</p>
<p dir=3D"ltr">Ralph Mitchell</p>
<div class=3D"gmail_quote">On Oct 8, 2012 12:50 PM, &quot;Matt Goebel&quot;=
 &lt;<a href=3D"mailto:user-74d13dabeb26@xymon.invalid">user-74d13dabeb26@xymon.invalid</a>=
&gt; wrote:<br type=3D"attribution"><blockquote class=3D"gmail_quote" style=
=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
Yes... /bin/logger is a binary...<br>
<br>
I seem to have figured out the issue, fping was being run as root by xymon,=
<br>
so I did the following :<br>
<br>
so I removed the sticky bit from user and group on /usr/local/sbin/fping<br=

<br>
then I did the following and restarted xymon<br>
<br>
add in : /etc/security/exec_attr<br>
Network Management:solaris:cmd:::/usr/local/sbin/fping:privs=3Dnet_icmpacce=
ss<br>
<br>
add in : /etc/user_attr<br>
xymon::::defaultpriv=3Dbasic,net_icmpaccess<br>
<br>
Matt<br>
<br>
--<br>
Matthew Goebel : <a href=3D"mailto:user-74d13dabeb26@xymon.invalid">goebel at emunix.e=
mich.edu</a> : Unix Jockey @ EMU : Hail Eris<br>
Neo-Student, Net Lurker, Donut consumer, and procrastinating medher...<br>
=A0&quot;Always with the negative waves, Moriarty&quot; - Oddball<br>
=A0&quot;Comfort the troubled, and trouble the comfortable.&quot; - Dietric=
h Bonhoeffer<br>
<br>
<a href=3D"mailto:Xymon at xymon.com">Xymon at xymon.com</a><br>
</blockquote></div>

--bcaec54fb0c030d40f04cb8f19b6--

-- 
Matthew Goebel : user-74d13dabeb26@xymon.invalid : Unix Jockey @ EMU : Hail Eris
Neo-Student, Net Lurker, Donut consumer, and procrastinating medher...
 "Always with the negative waves, Moriarty" - Oddball
 "Comfort the troubled, and trouble the comfortable." - Dietrich Bonhoeffer