| T.R | Title | User | Personal
Name | Date | Lines |
|---|
| 646.1 | | AUSS::GARSON | DECcharity Program Office | Mon May 26 1997 19:54 | 5 |
| re .0
As a test can you write a program to create a memory resident section
and see whether access auditting of it works correctly? It looks kind
of odd that there is no object name given.
|
| 646.2 | | UTRTSC::jgoras-197-2-3.jgo.dec.com::JurVanDerBurg | Change mode to Panic! | Tue May 27 1997 02:09 | 6 |
| >%AUDSRV-W-NOACTION, no alarm or audit name specified; requestor PID: 0000A86B
What's this process doing?
Jur.
|
| 646.3 | ANSWERS ... | LATINA::MAJOSE | MCS Madrid | Tue May 27 1997 05:02 | 28 |
|
RE .1
>>> As a test can you write a program to create a memory
>>> resident section and see whether access auditting of
>>> it works correctly?
We already did it.With a program using $CRMPSC and $MGBLSC
to create and map a global section (with alarms to
SYSTEM_GLOBAL_SECTION disabled),there is no problem .AUDIT
doesn't report any alarms.
The customer has already reported the problem to ORACLE
but we try to help them to solve it (any workaround
to disable these messages,if it's possible)
RE .2
>>> What's this process doing?
It's difficult to know what is doing all those processes
they are user processes that works with ORACLE,and
sometimes when we try to check what it was doing the
process doesn't exist.
Thanks and regards
M.Jos�.
MCSD Spain.
|
| 646.4 | ask perpetrator, not victim | GIDDAY::GILLINGS | a crucible of informative mistakes | Tue May 27 1997 19:15 | 15 |
| M.Jose,
> >>> What's this process doing?
>
> It's difficult to know what is doing all those processes
> they are user processes that works with ORACLE,and
> sometimes when we try to check what it was doing the
> process doesn't exist.
The key to this whole issue is the process which is sending an
unrecognised audit message. Use ACCOUNTING to trace the name and
completion status of the process and ask whoever is responsible
for the process (application programmers, Oracle etc..) what it
is/is supposed to be doing.
John Gillings, Sydney CSC
|
| 646.5 | | AUSS::GARSON | DECcharity Program Office | Tue May 27 1997 20:05 | 14 |
| re .3
But did you try a memory resident section? And one would want an alarm ACE
on the section.
Obviously Oracle is using that feature of VMS which is probably not
widely used so I don't accept without some investigation that it is
necessarily an Oracle problem.
Yes, it might be that Oracle is explicitly generating its own audit
records and they might be screwing up but before flick passing to
Oracle one would want to be more certain. As a start you might want to
ask Oracle whether they generate audit records.
|
| 646.6 | | AUSS::GARSON | DECcharity Program Office | Tue May 27 1997 20:07 | 2 |
| P.S. Perhaps turning off alarms for illformed audit records (see
display in .0 which shows this to be on) will hide the problem.
|
| 646.7 | Disabling illformed audit ... No efect. | LATINA::MAJOSE | MCS Madrid | Mon Jun 02 1997 04:35 | 19 |
|
>>> Perhaps turning off alarms for illformed audit records,
>>> will hide the problem.
No.We disabled alarms for illformed audit records,but
it wasn't fine.
If we get disabled this alarms,we would be satisfied.
Any suggestion more ???
Thanks and regards,
M.Jos�.
MCSD Spain.
|
| 646.8 | | COMEUP::SIMMONDS | loose canon | Tue Jun 03 1997 02:02 | 20 |
| Re: .0,.7
This definitely looks like an $AUDIT_EVENT[W]() or AUDIT_SERVER problem..
and you should IPMT it.
In the interim, to stop those messages at their source, you could:
. Ask Oracle (how) to disable the auditing calls in their application code;
. Patch AUDIT_SERVER.EXE so it won't complain to OPCOM about NOACTION.
The %AUDSRV-W-NOACTION messages are sent to both CENTRAL and SECURITY
classes so to mask them, you'd need a $ REPLY/DISABL=(SECURITY,CENTRAL) on
OPA0:
.0> AUDIT hasn't enabled the alarms for GLOBAL_SECTION.The enabled alarms
System audit or alarm settings are ignored if you call $AUDIT_EVENT
with the NSA$M_MANDATORY bit set in the flags argument.
John.
|
| 646.9 | | ALPHAZ::HARNEY | John A Harney | Tue Jun 03 1997 08:27 | 16 |
| re: .7, .8
The audit server maintainer is listening.
It seems from here like an application error. The server is complaining
that it can't understand the audit request. It's telling you the PID
of the requestor so you can find out what they're doing, and fix the
application.
As .8 mentioned, check the FLAGS field in the SYSUAF entry for the user
in question, and see if the AUDIT flag is set.
Also, an IPMT case is, as .8 said, the only official way of having
this looked at.
\john
|
| 646.10 | Problem with sys$mgblsc_64 | EVMS::NOEL | | Tue Jun 03 1997 13:47 | 15 |
| I've found a problem with the system serivce sys$mgblsc_64 which is
called by Oracle V7.3.2 to map the SGA.
The test for the audit mask is supposed to be a word and was programmed
as a longword in the new C code. Unfortunately, there is no structure
definition for the field being tested. Mapping to the global section
seems to always cause an audit. (I didn't check what the upper word is
defined as.)
I logged a QAR, EVMS-RAVEN #1165, so I can track the problem. If possible
reference this QAR number in the IPMT so people know the problem is being
fixed in VMS engineering.
- Karen
|
| 646.11 | (With bullet graze on hip.. :-) | COMEUP::SIMMONDS | loose canon | Wed Jun 04 1997 23:36 | 9 |
| Re: .9 (by John "A for Audit" Harney :):)
My apologies.. seems that syscrmpsc does its auditing rather 'directly'
and does not use $AUDIT_EVENT (which would likely have stopped the bad
event packet (which from the mailbox dump given in .0 seems to be
missing an alarm or audit Name) from going any further)
Thanks,
John.
|