question Re: Solaris 11 active process discovery without /usr/ucb in ITOM forum

Solaris 11 active process discovery without /usr/ucb

Paul Ciarfella — Tue, 11 Jul 2017 20:37:08 GMT

The Solaris probe "Solaris - Active Processes" requires /usr/ucb/ps. But our server architect is against installing /usr/ucb and polluting the beauty of the Solaris installation with outside packages.

Has anyone successfully modified active process discovery to support Solaris 11 without /usr/ucb installed? Discovery documentation says its required for Solaris 10 and below, and /usr/bin/ps for Solaris 11, but the probes definitely do not work on Solaris 11 if /usr/ucb is not installed.

I'm thinking we're going to need to write a custom probe assuming that the output from /usr/bin/ps can be output in a compatible digestible format.

Re: Solaris 11 active process discovery without /usr/ucb

karmeng — Wed, 12 Jul 2017 04:24:46 GMT

Hi Paul,

/usr/ucb is needed for Solaris 11 as Discovery need to use this command for output.

Documentation

UNIX and Linux commands requiring root privileges for Discovery and Orchestration

KB:

ServiceNow Customer Service System

I hope this sufficient to convince the server architect

Thank you.

Regards,

Kar Meng

Re: Solaris 11 active process discovery without /usr/ucb

Paul Ciarfella — Wed, 12 Jul 2017 11:15:01 GMT

Thanks for pointing out the documentation. I didn't notice that it was updated in Helsinki.

That's probably not enough to convince the architect and we'd need to update over 300 production servers, which is another big roadblock.

We'll see if we can modify the probe to get at least some of the running process information.

Re: Solaris 11 active process discovery without /usr/ucb

Paul Ciarfella — Thu, 13 Jul 2017 01:55:17 GMT

So the answer is that Solaris 11 provides a backwards compatibility option for /usr/bin/ps to generate output that matches the ucb version of ps.

For example, the "Solaris - Active Processes" probe runs "/usr/ucb/ps -awwx" to get process information.

The equivalent Solaris 11 ps command is "/usr/bin/ps awwx". Eliminating the leading '-' in the command arg tells ps to go retro and run like the ucb ps.

I modified the bash script in the probe to check the OS version and run the ucb ps or the Solaris 11 ps depending on OS (11 or 5.11 for example).

Re: Solaris 11 active process discovery without /usr/ucb

karmeng — Thu, 13 Jul 2017 02:33:49 GMT

Hi Paul,

Thanks for your update. Sounds that you found the workaround for the issue by modified the bash script. Glad you update the result and I believe it will benefit community members who have similar requirement .

Appreciate if you can mark this thread as answered with the comment that you provide earlier.

Regards,

Kar Meng

Re: Solaris 11 active process discovery without /usr/ucb

jimfreeman — Thu, 27 Jul 2017 00:21:51 GMT

Paul,

Do you know of any documentation of this "no dash" mode for /usr/bin/ps, and if it is supported in all versions of Solaris 11? Below is all I could find, none of it "official" such as an Oracle man page:

- Solaris 11 man page for /usr/bin/ps Synopsis - man pages section 1: User Commands doesn't show a "no dash" syntax.

- Oracle blog SRU 5.6: updates in ps(1) and /proc/<pid>/{cmdline,environ,execname} | Oracle Casper Dik's Blog talks about /usr/bin/ps removing the 80 column limit starting with Solaris 11.3, but no mention about "no dash" mode.

- unix - PS Command in Solaris - Super User says "On Solaris 11, if you use options without a dash (like /usr/bin/ps auxwww) they will be treated as UCB style options, and the output will show extra long lines, even when you are NOT running as root." but does he mean all versions of Solaris 11? His comment contains 3 more links, but they didn't help much.

thanks, Jim

Re: Solaris 11 active process discovery without /usr/ucb

Paul Ciarfella — Thu, 27 Jul 2017 15:54:02 GMT

Hi Jim -

Here is where I learned about the BSD compatibility option:

Solaris 11 Changes: Where is the BSD style ps command? | Scaling Bits

I've not yet been able to try this on a Solaris 11 system, only 5.11.

Paul

Re: Solaris 11 active process discovery without /usr/ucb

jimfreeman — Thu, 27 Jul 2017 22:36:28 GMT

Paul, thanks for that Scaling Bits blog link. Wish we could find some official Oracle documentation supporting this.

Re: Solaris 11 active process discovery without /usr/ucb

Abhishek Raj To — Wed, 06 Dec 2017 13:28:59 GMT

Paul, I am facing the same issue here wherein the "Active Processes" are not being picked by the solaris probe for V11.

Since, i am not familiar with solaris commands, can you help me out in modifying the existing probe. Following is the code:

#!/bin/sh

# Only get our processes, not our child zone processes

ZONENAME=$1

IFS="

ZONECMD=/usr/bin/zonename

PSCMD="/usr/bin/ps"

UCBPSCMD="/usr/ucb/ps"

PSARGS="-o pid,ppid"

AWKCMD="awk"

# First output just the heading for ps's output, tacking on a COMMAND column

echo PID PPID COMMAND

# Check for existence of zonename command

if [ ! -z "$ZONENAME" ]; then

ZONEPARAM="-z ${ZONENAME}"

elif [ -f $ZONECMD ]; then

# exists: limit ps to display processes for this zone

ZONEPARAM="-z `$ZONECMD`"

else

# doesn't exist: ps to display all processes

ZONEPARAM="-e"

# Replace awk command with nawk if it is available

# awk has a byte limit of 2559 bytes on older solaris machines

if hash nawk 2>/dev/null; then

AWKCMD="nawk"

# Iterate through each line of ps output...

for LINE in `$PSCMD $ZONEPARAM $PSARGS`; do

PID=`echo $LINE | $AWKCMD '{print $1}'`

# Check that this line isn't the header, and it's valid in /proc

if [ "$PID" != "PID" -a -f "/proc/$PID/status" ]; then

# use ucb/ps to get full, non-truncated command+args

CMD=`$UCBPSCMD -awwx $PID | tail +2 | $AWKCMD '{$1="";$2="";$3="";$4="";print $0}'`

# tack on the command+args to the output

echo $LINE $CMD

done

------------------

Also, would this command work: ps -aux

What changes do i need to make to the sensor script?

Thanks

Re: Solaris 11 active process discovery without /usr/ucb

Paul Ciarfella — Wed, 06 Dec 2017 20:12:24 GMT

Abhishek,

Here's the revised ps.sh script:

Paul

#!/bin/sh -x

# Only get our processes, not our child zone processes

ZONENAME=$1

IFS="

ZONECMD=/usr/bin/zonename

PSCMD="/usr/bin/ps"

UCBPSCMD="/usr/ucb/ps -awwx"

PSARGS="-o pid,ppid"

AWKCMD="awk"

# PWC Solaris 10 and older have ucb/ps installed. Solaris 11 does not.

# But Solaris 11 generates /usr/bin/ps compatible output for when -

# is not at the front of the first command argument.

SOLVERSION=`uname -r`

# First output just the heading for ps's output, tacking on a COMMAND column

echo PID PPID COMMAND

# Check for existence of zonename command

if [ ! -z "$ZONENAME" ]; then

ZONEPARAM="-z ${ZONENAME}"

elif [ -f $ZONECMD ]; then

# exists: limit ps to display processes for this zone

ZONEPARAM="-z `$ZONECMD`"

else

# doesn't exist: ps to display all processes

ZONEPARAM="-e"

# Replace awk command with nawk if it is available

# awk has a byte limit of 2559 bytes on older solaris machines

if hash nawk 2>/dev/null; then

AWKCMD="nawk"

# Iterate through each line of ps output...

for LINE in `$PSCMD $ZONEPARAM $PSARGS`; do

PID=`echo $LINE | $AWKCMD '{print $1}'`

# Check that this line isn't the header, and it's valid in /proc

if [ "$PID" != "PID" -a -f "/proc/$PID/status" ]; then

# use ucb/ps to get full, non-truncated command+args

if [[ "$SOLVERSION" == *"11"* ]]; then

CMD=`/usr/bin/ps awwx $PID | tail +2 | $AWKCMD '{$1="";$2="";$3="";$4="";print $0}'`

else

CMD=`/usr/ucb/ps -awwx $PID | tail +2 | $AWKCMD '{$1="";$2="";$3="";$4="";print $0}'`

# tack on the command+args to the output

echo $LINE $CMD

done

Re: Solaris 11 active process discovery without /usr/ucb

jimfreeman — Wed, 06 Dec 2017 20:21:36 GMT

I sure wish Oracle would document this BSD compatibility mode (/usr/bin/ps awwx), and if it's available starting with the first rev of v11.

Jim