PDA

View Full Version : su: (to oracle) root on none



amginenigma
08-Jul-2014, 22:01
Title says it all, had a server require a re-boot yesterday; now every 10seconds to 2minutes I receive line after line after line of

su: (to oracle) root on none

I've asked my DBA who is running Oracle Cloud Control on this server to check his settings, he notes there is no clustering and this server does not have SLES HA extensions (which google-fu leads one to believe is the culprit). The Oracle forums are of no use as they point the DBA's back to the SYS Admin and say it's my fault.

I've never seen this, anyone have a clue what this may be?

Thanks,

malcolmlewis
09-Jul-2014, 05:57
Hi
Looking here (whilst systemd related) shows the events your seeing
http://www.oracle-base.com/articles/linux/linux-services-systemd.php

So how are the oracle services starting on your system in /etc/init.d (dbora?)?

To me that would indicate the service is going up and down by automatically restarting....

amginenigma
09-Jul-2014, 15:24
This is a plain vanilla SLES11 server, Oracle was installed by selecting orarun in software management. A 3rd party vendor installed Oracle Cloud Control in addition to the Oracle 11 database; unfortunately as is becoming the case around here this was all done without involving the systems guys (myself) and now that vendor is no longer on contract; yet we (the systems guys) are expected to figure out what he did and 'fix' it even though we had no hand in the setup.

I believe Oracle starts via the /etc/init.d/oracle script, I know the DBA's have a few custom scripts on the server, but I believe the defaults created with the install of the 'orarun' package are doing the heavy lifting to start the databases.

I'd agree it appears as though a service is attempting to start, failing, then attempting a re-start, however how do I tell what that is?

Thanks!

jmozdzen
09-Jul-2014, 17:05
Hi amginenigma,

I'd agree it appears as though a service is attempting to start, failing, then attempting a re-start, however how do I tell what that is?

Try using "ls -ulrt /etc/init.d|tail" to have the rc files displayed with and sorted by their last access time, most current listed last. If the rc file is invoked over and over again, it should be the last entry in the list. Unless it isn't a standardized setup, but a distinct init script in the run-level directory - you'd then i.e. use "ls -ulrt /etc/init.d/rc5.d|tail" if your current runlevel is 5 (see "runlevel" command).

Regards,
Jens

malcolmlewis
09-Jul-2014, 17:07
On Wed 09 Jul 2014 02:34:01 PM CDT, amginenigma wrote:


This is a plain vanilla SLES11 server, Oracle was installed by selecting
orarun in software management. A 3rd party vendor installed Oracle
Cloud Control in addition to the Oracle 11 database; unfortunately as is
becoming the case around here this was all done without involving the
systems guys (myself) and now that vendor is no longer on contract; yet
we (the systems guys) are expected to figure out what he did and 'fix'
it even though we had no hand in the setup.

I believe Oracle starts via the /etc/init.d/oracle script, I know the
DBA's have a few custom scripts on the server, but I believe the
defaults created with the install of the 'orarun' package are doing the
heavy lifting to start the databases.

I'd agree it appears as though a service is attempting to start,
failing, then attempting a re-start, however how do I tell what that
is?

Thanks!




Hi
So what are all the oracle scripts in /etc/init.d? Have you checked for
user cron jobs (including root user) and system cron jobs in /etc/cron.*
that maybe running?

--
Cheers Malcolm °¿° SUSE Knowledge Partner (Linux Counter #276890)
openSUSE 13.1 (Bottle) (x86_64) GNOME 3.10.1 Kernel 3.11.10-17-desktop
If you find this post helpful and are logged into the web interface,
please show your appreciation and click on the star below... Thanks!

amginenigma
09-Jul-2014, 18:24
Thanks for the input, from your post here is what is listed

ls -ulrt /etc/init.d|tail
-rwxr-xr-x 1 root root 9645 2014-07-09 09:51 setserial
-rwxr-xr-x 1 root root 12220 2014-07-09 09:51 kbd
-rwxr-xr-x 1 root root 1212 2014-07-09 09:51 inputattach
-rwxr-xr-- 1 root root 3356 2014-07-09 09:51 nmb
-rwxr-xr-x 1 root root 13773 2014-07-09 09:51 ipmi
drwxr-xr-x 2 root root 4096 2014-07-09 10:00 rc3.d
drwxr-xr-x 2 root root 4096 2014-07-09 10:00 rc5.d
drwxr-xr-x 2 root root 4096 2014-07-09 10:00 rc4.d
drwxr-xr-x 2 root root 4096 2014-07-09 10:00 rc2.d
drwxr-xr-x 2 root root 4096 2014-07-09 10:00 boot.d

I ran that a dozen times just before and just after the su: (to oracle) root on none appears, the order of items rarely changed; boot.d is always last setserial is always first.

Anything look out of the ordinary there to you?

amginenigma
09-Jul-2014, 18:24
I've checked both crontab for root and the oracle user, they are blank.

malcolmlewis
09-Jul-2014, 19:27
Hi
What about the output from the command pstree and the oracle apps, see anything in there bouncing?

Does the log message also indicate the PID?

jmozdzen
10-Jul-2014, 10:06
Hi amginenigma,

> Anything look out of the ordinary there to you

what conclusion would you draw from that output? You're the one who knows what your system *should* do...

Another thought, following Malcolm's direction: Maybe it's not a script that is re-run continuously, but rather one of the scripts is looping around a "start service, monitor service, restart service" sequence... it's be something you might catch in "ps ax", if looking at the right time or if that script accumulates cpu time above normal.

Regards,
Jens

amginenigma
10-Jul-2014, 23:04
Learn something new every day, I've never seen the output to pstree before but that is very useful information! Thanks!

Unfortunately I have no idea what it is that su (oracle) to root is even trying to do, so I don't know what process to look at. There are plenty of processes shown, but yea the issue is how do I determine which is related to this message in the logs and which is simple background noise?

Is there a way to view which processes are acting upon a given directory? Example I believe this is related to oracle (though I could be wrong) and I know oracle's home is /u01. I know I can do a lsof to see what's open, can I craft a similar statement to use pstree (or ???) to see everything that's going on in there?

malcolmlewis
10-Jul-2014, 23:29
On Thu 10 Jul 2014 10:14:01 PM CDT, amginenigma wrote:


Learn something new every day, I've never seen the output to pstree
before but that is very useful information! Thanks!

Unfortunately I have no idea what it is that su (oracle) to root is even
trying to do, so I don't know what process to look at. There are plenty
of processes shown, but yea the issue is how do I determine which is
related to this message in the logs and which is simple background
noise?

Is there a way to view which processes are acting upon a given
directory? Example I believe this is related to oracle (though I could
be wrong) and I know oracle's home is /u01. I know I can do a lsof to
see what's open, can I craft a similar statement to use pstree (or ???)
to see everything that's going on in there?




Hi
Something like


pstree -acpls <username>

I guess orarun for the user?

Look at the man page for pstree or pstree -help ;)


--
Cheers Malcolm °¿° SUSE Knowledge Partner (Linux Counter #276890)
openSUSE 13.1 (Bottle) (x86_64) GNOME 3.10.1 Kernel 3.11.10-17-desktop
If you find this post helpful and are logged into the web interface,
please show your appreciation and click on the star below... Thanks!

silviumc
16-Jul-2014, 12:14
Look at the end of /etc/inittab see if there's something that appears to belong to oracle.